The issue: Patching updates your dependencies to remove the vulnerability. But if attackers exploited it during that window, they could have:
Injected backdoors into components or middleware Added obfuscated malicious code (eval/atob patterns) Planted crypto miners or data exfiltration hooks Modified server actions to leak credentials
Patching doesn't retroactively remove this code. Our experience: We patched immediately on Dec 9. Then spent 6 hours manually auditing our Next.js codebase and found 2 suspicious modifications we didn't write (obfuscated eval calls in middleware). What we built: An AST-based scanner to automate this. It checks for 80+ Indicators of Compromise:
Code obfuscation patterns Unauthorized network calls Modified Next.js internals Crypto mining signatures CVE-2025-55182-specific exploit artifacts
Runs in 30 seconds vs. our 6-hour manual audit. Questions for HN:
Are companies doing post-patch audits, or assuming they're clean? Is there existing tooling for this that we missed? For high-value targets (fintech, healthcare), what's the recommended approach?
We open-sourced the scanner here: [https://github.com/Alcatecablee/Neurolint-CLI/] Curious how others are approaching this, seems like a blind spot in the patching narrative.