{"id":"MAL-2026-14249","summary":"Malicious code in localize-extract (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (265d3f1cc9dae0e1599e17054e0cebe1481224741d3c3dce5d78916feebd5da2)\nlocalize-extract@1.0.0 executes a postinstall script that collects host identifiers (os.hostname(), platform, arch, node version, package name, lifecycle event) and POSTs them as JSON to the hardcoded endpoint https://1zrgq9h2.instances.poc.jchunt.top/localize-extract at npm install time. The package name resembles @angular/localize and the tarball references the upstream angular/localize package.json, consistent with a dependency-confusion / typosquat probe. Data leaves the installer's machine to an attacker-chosen host without consent on install.\n","modified":"2026-08-19T05:00:16.354159747Z","published":"2026-08-19T04:22:55Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-19T04:22:55Z","sha256":"265d3f1cc9dae0e1599e17054e0cebe1481224741d3c3dce5d78916feebd5da2","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-018362","import_time":"2026-08-19T04:47:47.319532703Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/localize-extract/v/1.0.0"}],"affected":[{"package":{"name":"localize-extract","ecosystem":"npm","purl":"pkg:npm/localize-extract"},"versions":["1.0.0"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"7c01fec1d2f656312bb852c028f1ae0b93faf223370620b569c404e93f8d1fa00321ad","path":"postinstall.js","sha256":"964ed42b2a706f6a9226ee88daedcf6c711b89800272977af3a9746a07f818e5"}],"package_integrity":[{"hashes":{"sha1":"bbaa7c189ce14bcf00d23f5377cae8671bc4cc4f","sha512_sri":"sha512-xVPGXnvM1k1JUUNJZJQTqzdjs3rU+rlOFYGWgyTWB53ZvfgJsEyJKaOIq82K90RZ1DYWi0e+D5fvm3dlWquC2A=="},"filename":"localize-extract-1.0.0.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/localize-extract/MAL-2026-14249.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}