localization-fixer

Details

**Severity:** Critical

**Affected versions:** `= 1.1.1`

## Source: amazon-inspector (72446c1307e81047c64d819d3485fa77062061c8c9d4d0b38b42e311137c8701)
On require of the package's main entry, a top-level `if (isServer) syncLanguageSystem()` fetches a JSON payload from https://api.jsonbin.io/v3/b/6a764665da38895dfec7cd5d and executes the returned `record.value` field as JavaScript, both by writing it to a temp file and running it via `child_process.fork` and via `new Function('require', payload)(require)` in a separate module-load IIFE that pulls https://api.jsonbin.io/v3/b/6a718a58da38895dfeb6e2ed. Both sinks pass the Node `require` to the constructed function, granting full Node capabilities to whatever the mutable jsonbin.io bin currently serves. Function and variable names (`syncLanguageSystem`, `LANG_SOURCE`, `lang_pass_key`) frame the fetch-and-exec as a localization-sync feature, but the advertised purpose of the package has no need to evaluate remote bytes. The jsonbin.io bins are attacker-mutable, so the payload delivered to any installer is arbitrary and can change at any moment.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/f4865d38bdd8cf89a75895cd20168baaaa03aea4/osv/malicious/npm/localization-fixer/MAL-2026-13631.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/f4865d38bdd8cf89a75895cd20168baaaa03aea4/osv/malicious/npm/localization-fixer/MAL-2026-13631.json
- https://www.npmjs.com/package/localization-fixer/v/1.0.1
- https://www.npmjs.com/package/localization-fixer/v/1.1.1
- https://github.com/advisories/GHSA-744p-7qm5-8wpj

Compromised versions (1)

• = 1.1.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.