Malicious code in cat-embed-i18n-res (npm)

The cat-embed-i18n-res npm package version 1.0.0 ships a strings.json file intended as an i18n translation resource but actually contains malicious HTML/JavaScript XSS payloads. These payloads use event handlers such as <img src=x onerror=...> and <svg onload=...> to execute JavaScript that sends document.domain and document.cookie to https://notpismo.cloud/c. Any application rendering these strings as HTML will inadvertently execute the script, exposing user session cookies and domain data to the attacker-controlled endpoint. The package name and resource framing serve as a disguise for the malicious payload, with no legitimate localization content present.

If an application uses this package and renders the strings.json content as HTML, it will execute the embedded scripts in the end user's browser. This results in the theft of session cookies and domain information, which can lead to session hijacking and unauthorized access to user accounts or sensitive data. The compromise affects users of applications that incorporate this malicious package version 1.0.0.

No official patch or remediation is currently documented. Users should immediately remove or avoid using cat-embed-i18n-res version 1.0.0. Applications should never render untrusted i18n resource content as HTML without proper sanitization. Monitor vendor advisories for updates or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.