Malicious code in localize-extract (npm)
localize-extract@1.0.0 on npm contained malicious postinstall code that exfiltrated host identifiers to an attacker-controlled endpoint. The package name resembled @angular/localize, suggesting a dependency-confusion or typosquatting attack.
- Disclosed
- Last updated
- Blast radius
- Any developer or system installing localize-extract@1.0.0 from npm
- Ecosystems
- Attack vectors
- Affected entities
- localize-extract · 1.0.0
localize-extract@1.0.0 was published to npm with a malicious postinstall script that executed during package installation. The script collected host identifiers including hostname, OS platform, architecture, Node.js version, package name, and lifecycle event information, then POSTed this data as JSON to https://1zrgq9h2.instances.poc.jchunt.top/localize-extract without user consent.\n\nThe package name closely resembles @angular/localize, and the tarball referenced the upstream angular/localize package.json, indicating this was likely a dependency-confusion or typosquatting probe designed to trick developers into installing the malicious package instead of the legitimate Angular localization library.\n\nData exfiltration occurred automatically at npm install time, affecting any developer or system that installed this specific version. The incident was identified and reported through the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- localize-extract
- Domains
- 1zrgq9h2.instances.poc.jchunt.top
- Hashes
- 265d3f1cc9dae0e1599e17054e0cebe1481224741d3c3dce5d78916feebd5da2
Remediation
- Immediately uninstall localize-extract@1.0.0 from all systems and projects
- Audit npm install logs and package-lock.json files to identify if this package was installed
- Review network logs for connections to https://1zrgq9h2.instances.poc.jchunt.top/localize-extract
- Regenerate any credentials or sensitive information that may have been exposed on affected systems
- Use npm audit to scan for other malicious packages
- Consider using npm package name verification and dependency confusion detection tools
- Pin dependencies to known-good versions and use lock files
Sources
- GitHub Advisory GHSA-hhg6-p2wv-g5w2 · GitHub Advisory Database
Cite this entry
"Malicious code in localize-extract (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-localize-extract-npm-ioifoe
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in bazelisk (npm)
A malicious npm package named bazelisk, impersonating Google's legitimate bazelbuild/bazelisk project, was published with a postinstall script that exfiltrates system and environment information to an attacker-controlled server. The package exhibits dependency-confusion and typosquatting characteristics, collecting hostname, platform, architecture, Node version, and npm lifecycle event data.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in gaarf-node-bq (npm)
gaarf-node-bq is a malicious npm package that acts as a dependency-confusion/typosquat canary targeting Google's internal gaarf package. The package's postinstall script collects host metadata and exfiltrates it to an external endpoint without user consent.
npmDependency confusionTyposquattingCompromised package - resolvedcritical
Malicious code in ngsw-config (npm)
A malicious npm package named ngsw-config was published to shadow Angular's legitimate tooling. The package's postinstall script collected and exfiltrated host identifiers (hostname, platform, architecture, Node version, package/lifecycle name, timestamp) to a hardcoded endpoint without consent or documentation, targeting dependency-confusion scenarios in internal build systems.
npmCompromised packageTyposquattingDependency confusion - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting