OpenSSF/OSV advisory MAL-2026-14249 confirms this npm version as malicious. localize-extract@1.0.0 executes a postinstall script that collects host identifiers (os.hostname(), platform, arch, node version, package name, lifecycle event) and POSTs them as JSON to the hardcoded endpoint https://1zrgq9h2.instances.poc.jchunt.top/localize-extract at npm install time. The package name resembles @angular/localize and the tarball references the upstream angular/localize package.json, consistent...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in localize-extract (npm)
Details
localize-extract@1.0.0 executes a postinstall script that collects host identifiers (os.hostname(), platform, arch, node version, package name, lifecycle event) and POSTs them as JSON to the hardcoded endpoint https://1zrgq9h2.instances.poc.jchunt.top/localize-extract at npm install time. The package name resembles @angular/localize and the tarball references the upstream angular/localize package.json, consistent with a dependency-confusion / typosquat probe. Data leaves the installer's machine to an attacker-chosen host without consent on install.
Decision reason
OpenSSF Malicious Packages via OSV confirms localize-extract@1.0.0 as malicious (MAL-2026-14249): Malicious code in localize-extract (npm)