require-i18next

{"schema_version":"1.7.4","id":"MAL-2026-14052","published":"2026-08-15T13:43:39Z","modified":"2026-08-15T16:10:05.396291911Z","summary":"Malicious code in require-i18next (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5b5f50249e747ea23b84fdc6baa2202e9d786a872fd7d9a545017dc6fc5ad788)\nThe package's preinstall.js reads a hex-encoded command string from preinstall.json, decodes it with Buffer.from(hex, 'hex'), and passes the result to child_process.exec during `npm install`. The decoded payload is a curl command that POSTs the installer's whoami, current working directory, hostname, and the contents of /etc/passwd to https://eousft8gflamm91.m.pipedream.net. The name resembles the legitimate i18next ecosystem but the package's only observed behavior is install-time data exfiltration to an attacker-controlled Pipedream webhook, with the payload obfuscated as hex in a sibling JSON file to evade inspection of the JS.\n\n## Source: ossf-package-analysis (6ea984228059ea2f54b4cb42d16a5f3f42f3144902c418be08c5000576de58f1)\nThe OpenSSF Package Analysis project identified 'require-i18next' @ 20.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"name":"require-i18next","ecosystem":"npm"},"versions":["20.0.0","21.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"preinstall.js","sha256":"913112caf871d2cd2a23e6becb67ec28401cc294e424d6bf22985c4e1f404bc2","tlsh":"edf07d052dfa1237403b20a54a47580b318ad901313edda2bbee5b516fc5c64cca36c9"},{"path":"preinstall.json","sha256":"cde092f68c713fa5284d9a8d7a47648459e3c25556310b61d1f0434512eb3f56","tlsh":"51d05ef842c1d1c3e228419e27ae39052e52636698910e51d119bd806c68501be7c0b8"}],"package_integrity":[{"filename":"require-i18next-21.0.0.tgz","hashes":{"sha1":"ee6b796be8c1ec6e1f79e777978784a3842199f9","sha512_sri":"sha512-5SvyEJjxcasekOsHFDBFJHDeyvf5fjuqMN37om9CLWScZbn9hsSX9KZKK0o8yDAR2XnivYksjQDQfh4RI8Uxjw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/require-i18next/v/21.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/require-i18next/v/20.0.0"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-15T13:43:45.197838589Z","modified_time":"2026-08-15T13:43:39Z","sha256":"6ea984228059ea2f54b4cb42d16a5f3f42f3144902c418be08c5000576de58f1","source":"ossf-package-analysis","versions":["20.0.0"]},{"import_time":"2026-08-15T14:08:47.53065476Z","modified_time":"2026-08-15T13:49:29Z","sha256":"6120fb66e65a0dd5620f99a5777f86a7ca2ca08224e3dce45496a548f2236c96","source":"ossf-package-analysis","versions":["21.0.0"]},{"id":"IN-MAL-2026-017935","import_time":"2026-08-15T16:07:54.722667039Z","modified_time":"2026-08-15T15:44:01Z","sha256":"5b5f50249e747ea23b84fdc6baa2202e9d786a872fd7d9a545017dc6fc5ad788","source":"amazon-inspector","versions":["21.0.0"]},{"id":"IN-MAL-2026-017934","import_time":"2026-08-15T16:07:54.660661196Z","modified_time":"2026-08-15T15:43:53Z","sha256":"e4efe52810a54d3c81c562901f32694f44ad9f14e2783140499358ab014969e1","source":"amazon-inspector","versions":["20.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}