modern-localization (npm) · Malicious Code
Affects modern-localizationSource GCVE Database
Malicious package : remove modern-localization and rotate any secrets on hosts that installed it.
Data as of 8 Aug 2026, 14:59 UTC
Malicious package
Published to npm · OSV MAL-2026-13633
What to do
Remove modern-localization from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmmodern-localization | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The modern-localization npm package versions 1.1.1 and 1.2.1 contain malicious code that fetches and executes arbitrary JavaScript from a third-party mutable key-value store without integrity checks. This behavior occurs via a top-level async function that performs HTTP GET requests to hardcoded jsonbin.io endpoints and executes the retrieved code with full Node.js privileges. Such execution of untrusted code poses a significant security risk, as the package masquerades as a localization library but performs unauthorized remote code execution.