3 months ago
It would appear that a malicious script has been injected into my app, potentially due to the recent Next.js security issue: https://station.railway.com/community/security-alert-react-next-js-remote-cod-2b0bab9d
The malicious script can be found here: https://static-6r1.pages.dev/min.js
I'm digging further into the issue, but looks like the source of the problem may be an outdated and vulnerable version of Umami which was installed via https://railway.com/new/template/umami-analytics about 7 months ago and last updated 1 month ago.
What promped me to identify the issue was that the gambling site 8617kryy.com was being opened in a new tab from both my main site, and also the umami dashboard.
They both seem to have been importing the malicious script https://static-6r1.pages.dev/min.js
Here are some further links:
https://www.reddit.com/r/nextjs/comments/1pm5ln8/i_was_hacked_help_me_understand_how/
https://github.com/umami-software/umami/issues/3852
https://github.com/vercel/next.js/discussions/87154
8 Replies
3 months ago
here's the min.js file incase cloudflare removes it from their pages.dev domain.
Attachments
3 months ago
i'm starting to investigate the logs and looks like some pretty suspicious activity was occurring.
3 months ago
This thread has been marked as public for community involvement, as it does not contain any sensitive or personal information. Any further activity in this thread will be visible to everyone.
Status changed to Open brody • 3 months ago
3 months ago
here's one of the logs, it looks like a malicious user is attempting to run commands.
Attachments
3 months ago
i'm having trouble sharing the logs, some of the files can't be uploaded presumably because they contain commands and are flagged by your firewall.
but essentially there were attempts made to scan the root directory and the etc/shadow directory at at around 2025-12-10T13:23:00 in the umami server
3 months ago
Hey Jowo,
I have the same issue on my website. An injected script that is replacing my external links on the website then redirect to a casino website.
3 months ago
Script present: https://static-6r1.pages.dev/min.js
Server header: server: railway-edge
Edge identifier: x-railway-edge: railway/europe-west4-drams3a
3 months ago
sorry to hear you're also encountering this issue. we're not alone, see the reddit and github links i posted above.
you should upgrade next and react ASAP and you should be able to resolve the issue.
see here: https://nextjs.org/blog/security-update-2025-12-11
i also took the extra precaution of rolling all of my app secrets incase they have been compromised - since this is a very serious vulnerability and i'm unsure at this point exactly what the scope of the breach is.
additionally i terminated the Umami analytics server/frontend/database for good measure, which was running alongside my main website.
And yeah, as mentioned i updated next, react and rolled my keys.
I also put my site into maintenance mode until i've managed to pick through the logs as best i can to figure out the extent of the breach.
3 months ago
Thanks, mate! My website is really simple with just a couple of page. I'm using CloudFlare but only the free version and there is nothing injected there. I'll have a look on the links and will upgrade Next.JS. Thanks a lot!