The modern-localization npm package versions 1.1.1 and 1.2.1 contain malicious code that fetches and executes arbitrary JavaScript from a third-party mutable key-value store without integrity checks. This behavior occurs via a top-level async function that performs HTTP GET requests to hardcoded jsonbin.io endpoints and executes the retrieved code with full Node.js privileges. Such execution of untrusted code poses a significant security risk, as the package masquerades as a localization library but performs unauthorized remote code execution.