MAL-2026-14052

Dashboard / Malicious Package / MAL-2026-14052

MAL-2026-14052

Summary: Malicious code in require-i18next (npm)

Details: Source: amazon-inspector (5b5f50249e747ea23b84fdc6baa2202e9d786a872fd7d9a545017dc6fc5ad788) The package's preinstall.js reads a hex-encoded command string from preinstall.json, decodes it with Buffer.from(hex, 'hex'), and passes the result to child_process.exec during `npm install`. The decoded payload is a curl command that POSTs the installer's whoami, current working directory, hostname, and the contents of /etc/passwd to https://eousft8gflamm91.m.pipedream.net. The name resembles the legitimate i18next ecosystem but the package's only observed behavior is install-time data exfiltration to an attacker-controlled Pipedream webhook, with the payload obfuscated as hex in a sibling JSON file to evade inspection of the JS. Source: ossf-package-analysis (6ea984228059ea2f54b4cb42d16a5f3f42f3144902c418be08c5000576de58f1) The OpenSSF Package Analysis project identified 'require-i18next' @ 20.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.

References: https://www.npmjs.com/package/require-i18next/v/21.0.0, https://www.npmjs.com/package/require-i18next/v/20.0.0