MAL-2026-14471

    Dashboard / Malicious Package / MAL-2026-14471

    MAL-2026-14471

    Published: 25 Aug 2026Last Modified: 25 Aug 2026

    Summary: Malicious code in cat-embed-i18n-res (npm)

    Details: Source: amazon-inspector (c612800e80bb36720e75741be9665ab6acbed58bcd5d51065fcedd1d990aaad0) The package's only shipped content, strings.json, is presented as an i18n/translation resource bundle but its values are HTML/JavaScript XSS payloads rather than localized text. Multiple entries use `<img src=x onerror=...>` and `<svg onload=...>` handlers that invoke fetch() against the hardcoded endpoint https://notpismo.cloud/c, sending `document.domain` and `document.cookie` as query parameters. Any consumer application that renders these strings as HTML (the ordinary use of an i18n bundle in web UIs) will execute the injected script in the end-user's browser and transmit that user's session cookies and hosting domain to notpismo.cloud. The package name and framing as a translation resource are a cover for the payload; there is no legitimate localization content in the file.

    References: https://www.npmjs.com/package/cat-embed-i18n-res/v/1.0.0

    Affected packages

    Package

    Name: cat-embed-i18n-res

    Purl: pkg:npm/cat-embed-i18n-res

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-14471 | CVE-DB