How to Remove Malware from a Hacked Next.js or Node.js App

Node.js and Next.js apps are compromised through the same doors as any web application — vulnerable dependencies, exposed secrets, or unvalidated input. Cleaning one means rotating your secrets, auditing your dependencies, finding injected code, and redeploying from a clean source. Version control makes this far easier.

Step 1: Rotate secrets and secure access

Change your hosting, database and any service credentials, and rotate every secret and API key in your environment variables. Take a full backup before changing files.

Step 2: Confirm environment files are not exposed

An exposed .env or config file leaks your secrets. Ensure such files are outside any publicly served directory and cannot be fetched in a browser.

Step 3: Audit dependencies

A compromised or malicious npm package is a common vector. Review your package.json and lockfile, run an audit for known vulnerabilities, remove anything unfamiliar, and reinstall dependencies cleanly from trusted sources.

Step 4: Find injected code and backdoors

Compare your codebase against version control to spot unauthorised changes, and scan the server — see scanning with Imunify360 — for uploaded files and backdoors. Check any database for injected content.

Step 5: Redeploy clean and harden

Rebuild from clean, verified code — ideally via Git — update Node and your framework, fix the underlying flaw, and follow the hardening checklist.

Frequently asked questions

How can a dependency be the cause?

Malicious or compromised npm packages can introduce backdoors or steal secrets during install or runtime. Auditing dependencies and pinning trusted versions is an essential part of Node security.

What is the fastest safe recovery?

If you have clean version control, redeploying from it after rotating all secrets is usually the fastest and safest route, because you know exactly what code you are running.

My secrets may have leaked — what now?

Rotate every affected secret and key immediately: database passwords, API keys, tokens. Assume anything that was exposed is compromised and replace it.