🚨 My Next.js app got hacked

🚨 My Next.js app got hacked — and here is what I learned.
This week, I discovered something alarming inside my production environment for rmbg.pro, my image background-removal app.
My Next.js container (running on Alpine) was being targeted by a malware dropper.
It attempted to download and execute a bot from a suspicious IP (176.117.107.154), override LD_PRELOAD, and run binaries like busybox and x86.
The attack caused repeated crashes and instability inside the container — but fortunately, no data leak.
After digging deeper, it became clear that the issue wasn’t from my application logic, but from the environment:
Possible vulnerable dependency allowing remote command execution
Or a supply-chain script running during build
Or a host-level compromise propagating into containers
🔥 This is where Trae EDI saved the day.
With Trae EDI’s help, we:
🔒 Rebuilt the Docker image using a multi-stage minimal node:20-alpine approach
🙅‍♂️ Removed root access and now run the app as a non-root Next.js user
🚫 Disabled all risky postinstall hooks with npm ci --ignore-scripts
📦 Shipped only the production-ready .next/standalone build
🧼 Removed all tools typically abused by malware (wget, curl, busybox, shell utilities)
🛡 Blocked outbound access to unknown IPs
🔁 Rotated all secrets (SMTP, API keys, tokens)
📊 Started dependency auditing + better CI security
These changes completely hardened the container, reduced the attack surface, and stopped the malicious process from running again.
⭐ A big THANK YOU to Trae EDI
for the deep analysis, clear explanations, and fast remediation.
Your guidance helped secure my infrastructure and protect rmbg.pro from further threats.
💬 Final Thought
If you're hosting Next.js apps on Docker/Alpine, don’t underestimate supply-chain attacks.
Run non-root, disable lifecycle scripts, restrict egress, and keep your host clean.
Stay safe & secure! 🔐

nextJs#docker#alpine#TraeEDI#npm#javaScript#security#hacker

Comments

[Shixian Sheng]

I wonder if it is related to the new 10.0 vulnerability found in Next.js (CVE-2025-66478), which originated from upstream React vulnerability that allowed remote code execution.