Malicious code in localization-fixer (npm)

The localization-fixer npm package contained embedded malicious code that executes on package initialization. When the package's main entry point is required, a top-level conditional check (if (isServer) syncLanguageSystem()) triggers a fetch from attacker-controlled jsonbin.io endpoints.\n\nThe malicious code retrieves JSON payloads from two separate jsonbin.io bins and executes the returned data as JavaScript through multiple execution paths: writing to a temporary file and executing via child_process.fork, and via new Function('require', payload)(require) in a separate module-load IIFE. Both execution methods pass the Node.js require function to the constructed code, granting full Node.js capabilities.\n\nThe functionality is disguised as a localization-sync feature through misleading function and variable names (syncLanguageSystem, LANG_SOURCE, lang_pass_key), but the package's advertised purpose has no legitimate need to evaluate remote code. Since the jsonbin.io bins are mutable by the attacker, the payload delivered to installers is arbitrary and can change at any moment, enabling dynamic malicious behavior.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.