Fake 'interview' repos lure Next.js devs into running secret-stealing malware

Microsoft reports a targeted campaign in which attackers publish malicious Next.js repositories that trigger during normal developer workflows (editor automation, npm run dev, backend initialization) to execute in-memory JavaScript loaders, connect to rotating C2 infrastructure, and retrieve follow-on tasks that can exfiltrate source code, secrets, and other sensitive developer-hosted assets. Defenders are advised to monitor unusual Node executions, unexpected outbound connections from developer machines, and follow-on discovery or upload behavior.