MAL-2026-13633

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/modern-localization/MAL-2026-13633.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13633
Published
2026-08-08T00:51:44Z
Modified
2026-08-08T01:49:47.599528842Z
Summary
Malicious code in modern-localization (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4be23667d11e7ef3357641973b9188175c2068bd2b580a5628773bcdf03533a5)

On server-side require of modern-localization, the package's main entry runs a top-level async IIFE (syncLanguageSystem) that performs an HTTP GET against a hardcoded jsonbin.io endpoint (https://api.jsonbin.io/v3/b/6a764665da38895dfec7cd5d and https://api.jsonbin.io/v3/b/6a718a58da38895dfeb6e2ed) and executes the returned string as JavaScript with full Node privileges. utils.js passes the fetched record.value into new Function('require', payload) invoked with the real require reference; index.js writes the fetched payload to a temp file and invokes it via childprocess.fork. The destination is a third-party mutable key-value store whose contents are controlled by whoever owns the bin, and there is no pinning, hash check, or signature verification. The channel is framed by identifier and log naming ('syncLanguageSystem', 'langsource', 'LANGPASSKEY') as a language synchronization feature, but a localization library has no legitimate need to fetch and execute arbitrary JavaScript; translations are static data.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "sha256": "fb8c3ecffe571be82855309d66a7e825cda13b98d046060c915e6c8e0dd0d70e",
            "import_time": "2026-08-08T00:53:09.878613066Z",
            "versions": [
                "1.1.1"
            ],
            "id": "IN-MAL-2026-017194",
            "modified_time": "2026-08-08T00:51:44Z"
        },
        {
            "source": "amazon-inspector",
            "sha256": "4be23667d11e7ef3357641973b9188175c2068bd2b580a5628773bcdf03533a5",
            "import_time": "2026-08-08T01:36:21.627772114Z",
            "versions": [
                "1.2.1"
            ],
            "id": "IN-MAL-2026-017201",
            "modified_time": "2026-08-08T00:53:12Z"
        }
    ]
}
References
Credits

Affected packages

npm / modern-localization

Package

Name
modern-localization
View open source insights on deps.dev
Purl
pkg:npm/modern-localization

Affected ranges

Affected versions

1.*
1.1.1
1.2.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/modern-localization/MAL-2026-13633.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "dist/index.js",
            "sha256": "2e6411d5da30033532d2a4170c22829776ccb2b71c651adcdf28e2a45fc4a008",
            "tlsh": "6d1264c99a93e1124473b3768b6f9014fd3a952b03268b45799dc1012fb056cc3eaee9"
        },
        {
            "path": "dist/utils.js",
            "sha256": "7d80b0b8279c7953e5bfd8df57ed649b6d44a2e99280850913d7077725378ab5",
            "tlsh": "eb81438597a2f1134533b3b2971f5414f83ad82602379a86ba9dc5512fb086c83fade4"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "6f0e83fcc1226f65fdc48e6abc1eaee533cfbb8c",
                "sha512_sri": "sha512-f6JQBYKmREZ7UXXi2cx4AqPZGN/xM9xC9jIE1x5KlICIaACHe5Jwrqk2luuE+zfWri3dpMHvjdyGgJa7hcZAbw=="
            },
            "filename": "modern-localization-1.1.1.tgz"
        }
    ]
}