localize-extract

{"modified":"2026-08-19T04:22:55Z","published":"2026-08-19T04:22:55Z","schema_version":"1.7.4","id":"MAL-2026-14249","summary":"Malicious code in localize-extract (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (265d3f1cc9dae0e1599e17054e0cebe1481224741d3c3dce5d78916feebd5da2)\nlocalize-extract@1.0.0 executes a postinstall script that collects host identifiers (os.hostname(), platform, arch, node version, package name, lifecycle event) and POSTs them as JSON to the hardcoded endpoint https://1zrgq9h2.instances.poc.jchunt.top/localize-extract at npm install time. The package name resembles @angular/localize and the tarball references the upstream angular/localize package.json, consistent with a dependency-confusion / typosquat probe. Data leaves the installer's machine to an attacker-chosen host without consent on install.\n","affected":[{"package":{"ecosystem":"npm","name":"localize-extract"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"964ed42b2a706f6a9226ee88daedcf6c711b89800272977af3a9746a07f818e5","tlsh":"7c01fec1d2f656312bb852c028f1ae0b93faf223370620b569c404e93f8d1fa00321ad"}],"package_integrity":[{"filename":"localize-extract-1.0.0.tgz","hashes":{"sha1":"bbaa7c189ce14bcf00d23f5377cae8671bc4cc4f","sha512_sri":"sha512-xVPGXnvM1k1JUUNJZJQTqzdjs3rU+rlOFYGWgyTWB53ZvfgJsEyJKaOIq82K90RZ1DYWi0e+D5fvm3dlWquC2A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/localize-extract/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018362","import_time":"2026-08-19T04:47:47.319532703Z","modified_time":"2026-08-19T04:22:55Z","sha256":"265d3f1cc9dae0e1599e17054e0cebe1481224741d3c3dce5d78916feebd5da2","source":"amazon-inspector","versions":["1.0.0"]}]}}