{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "dist/index.js",
              "sha256": "f001ddcd9587deed867673cd4900b1f67814939777406d6bd72691dceee22479",
              "tlsh": "461266c99a93e2224473b376871f5014fd3a942b03369b457d9ec1112fb056cc3eaee9"
            },
            {
              "path": "dist/utils.js",
              "sha256": "7d80b0b8279c7953e5bfd8df57ed649b6d44a2e99280850913d7077725378ab5",
              "tlsh": "eb81438597a2f1134533b3b2971f5414f83ad82602379a86ba9dc5512fb086c83fade4"
            }
          ],
          "package_integrity": [
            {
              "filename": "localization-fixer-1.1.1.tgz",
              "hashes": {
                "sha1": "02fcc9171b937628ac2bfbbaa87af3ded1b9f944",
                "sha512_sri": "sha512-j1QWe/U905M2umxzjWv0YTY/KuQzwcXltN5OE6AgNUoiU/vIpnS5lXsReaAvTogEpiAGRTJ8QD9L8Ac1iHhf9A=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "localization-fixer"
      },
      "versions": [
        "1.1.1",
        "1.0.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-017195",
        "import_time": "2026-08-08T00:53:09.934973234Z",
        "modified_time": "2026-08-08T00:51:51Z",
        "sha256": "72446c1307e81047c64d819d3485fa77062061c8c9d4d0b38b42e311137c8701",
        "source": "amazon-inspector",
        "versions": [
          "1.1.1"
        ]
      },
      {
        "id": "IN-MAL-2026-017193",
        "import_time": "2026-08-08T00:53:09.819332415Z",
        "modified_time": "2026-08-08T00:51:34Z",
        "sha256": "cce6487bd92f993e2f16873190e8e9f9fa5727509802c1db2a37e8be70c26343",
        "source": "amazon-inspector",
        "versions": [
          "1.0.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (72446c1307e81047c64d819d3485fa77062061c8c9d4d0b38b42e311137c8701)\nOn require of the package\u0027s main entry, a top-level `if (isServer) syncLanguageSystem()` fetches a JSON payload from https://api.jsonbin.io/v3/b/6a764665da38895dfec7cd5d and executes the returned `record.value` field as JavaScript, both by writing it to a temp file and running it via `child_process.fork` and via `new Function(\u0027require\u0027, payload)(require)` in a separate module-load IIFE that pulls https://api.jsonbin.io/v3/b/6a718a58da38895dfeb6e2ed. Both sinks pass the Node `require` to the constructed function, granting full Node capabilities to whatever the mutable jsonbin.io bin currently serves. Function and variable names (`syncLanguageSystem`, `LANG_SOURCE`, `lang_pass_key`) frame the fetch-and-exec as a localization-sync feature, but the advertised purpose of the package has no need to evaluate remote bytes. The jsonbin.io bins are attacker-mutable, so the payload delivered to any installer is arbitrary and can change at any moment.\n",
  "id": "MAL-2026-13631",
  "modified": "2026-08-08T00:55:08Z",
  "published": "2026-08-08T00:51:34Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/localization-fixer/v/1.1.1"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/localization-fixer/v/1.0.1"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in localization-fixer (npm)"
}