How a Clean Next.js Repo Ran Malware on Every npm run dev
A codebase I got through Fiverr looked like an ordinary Next.js invoice app. It wasn't. Two dependencies deep, gated behind an npm auth token committed in the project's own .npmrc, sat a private package carrying roughly 180 KB of heavily obfuscated JavaScript — wired to execute every time the dev server starts. I caught it before running it. Here is the short version. package.json scripts held only dev, build, start and lint. No preinstall, no postinstall, no prepare. A grep for the usual suspe…