Malicious code in modern-localization (npm)
The modern-localization npm package versions 1.1.1 and 1.2.1 contain malicious code that fetches and executes arbitrary JavaScript from a third-party mutable key-value store without integrity checks. This behavior occurs via a top-level async function that performs HTTP GET requests to hardcoded jsonbin.io endpoints and executes the retrieved code with full Node.js privileges. Such execution of untrusted code poses a significant security risk, as the package masquerades as a localization library but performs unauthorized remote code execution.
AI Analysis
Technical Summary
The modern-localization npm package (versions 1.1.1 and 1.2.1) includes a top-level asynchronous immediately-invoked function expression (IIFE) named syncLanguageSystem that fetches JavaScript code from hardcoded jsonbin.io endpoints. The fetched code is executed dynamically using new Function and child_process.fork without any pinning, hash verification, or signature checks. This allows whoever controls the remote jsonbin.io bins to execute arbitrary code with full Node.js privileges on any system requiring this package. The package pretends to be a localization tool, but its legitimate functionality does not require fetching or executing remote JavaScript, indicating malicious intent.
Potential Impact
This vulnerability enables remote code execution with full Node.js privileges on any system that requires the affected versions of the modern-localization package. Because the remote code source is mutable and uncontrolled, an attacker can modify the payload at any time to execute arbitrary commands, potentially leading to complete system compromise, data theft, or further malware deployment.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately stop using the modern-localization package versions 1.1.1 and 1.2.1. Remove these versions from all environments and replace them with trusted alternatives. Since the package fetches and executes remote code without verification, it should be considered malicious and untrusted. Monitor for any usage of this package in your dependency tree and remove it promptly. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.
Malicious code in modern-localization (npm)
Description
The modern-localization npm package versions 1.1.1 and 1.2.1 contain malicious code that fetches and executes arbitrary JavaScript from a third-party mutable key-value store without integrity checks. This behavior occurs via a top-level async function that performs HTTP GET requests to hardcoded jsonbin.io endpoints and executes the retrieved code with full Node.js privileges. Such execution of untrusted code poses a significant security risk, as the package masquerades as a localization library but performs unauthorized remote code execution.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The modern-localization npm package (versions 1.1.1 and 1.2.1) includes a top-level asynchronous immediately-invoked function expression (IIFE) named syncLanguageSystem that fetches JavaScript code from hardcoded jsonbin.io endpoints. The fetched code is executed dynamically using new Function and child_process.fork without any pinning, hash verification, or signature checks. This allows whoever controls the remote jsonbin.io bins to execute arbitrary code with full Node.js privileges on any system requiring this package. The package pretends to be a localization tool, but its legitimate functionality does not require fetching or executing remote JavaScript, indicating malicious intent.
Potential Impact
This vulnerability enables remote code execution with full Node.js privileges on any system that requires the affected versions of the modern-localization package. Because the remote code source is mutable and uncontrolled, an attacker can modify the payload at any time to execute arbitrary commands, potentially leading to complete system compromise, data theft, or further malware deployment.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately stop using the modern-localization package versions 1.1.1 and 1.2.1. Remove these versions from all environments and replace them with trusted alternatives. Since the package fetches and executes remote code without verification, it should be considered malicious and untrusted. Monitor for any usage of this package in your dependency tree and remove it promptly. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13633
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a77428bbf8831d539b06dbf
Added to database: 08/08/2026, 14:51:55 UTC
Last enriched: 08/08/2026, 14:59:53 UTC
Last updated: 08/08/2026, 20:11:40 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.