Malicious code in localize-translate (npm)
The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed the malicious version of localize-translate
- Ecosystems
- Attack vectors
- Affected entities
- localize-translatenpm package with malicious postinstall script
The npm package localize-translate was found to contain malicious code embedded in its postinstall lifecycle script. Upon installation via npm install, the script automatically executed and collected host identifiers including hostname, platform, architecture, Node.js version, package name, and installation timestamp.
The collected data was exfiltrated via an HTTP POST request to a hardcoded, attacker-controlled endpoint at gigww0v7.instances.poc.jchunt.top/localize-translate. This endpoint was not a legitimate registry or service the installer consented to, and the beacon fired unconditionally on every host that installed the package.
While the reconnaissance was limited to host identity metadata (no credentials, filesystem contents, or environment variables were scraped), the undisclosed, unconditional nature of the callback and its direction to a third-party host indicates a malicious install-time reconnaissance operation rather than legitimate telemetry.
The incident was identified and credited to the OpenSSF's malicious-packages repository, which tracks confirmed supply chain compromises.
Indicators of compromise
- Packages
- localize-translate
- Domains
- gigww0v7.instances.poc.jchunt.top
Remediation
- Immediately uninstall the affected version of localize-translate from all systems
- Review npm audit logs and package-lock.json files to identify all hosts that installed the malicious version
- Consider the affected hosts as potentially compromised for reconnaissance purposes; review network logs for connections to gigww0v7.instances.poc.jchunt.top
- Update to a patched version of localize-translate if available, or use an alternative package
- Implement npm package scanning and verification in CI/CD pipelines to detect malicious postinstall scripts
- Monitor npm security advisories and the OpenSSF malicious-packages repository for similar threats
Sources
- GitHub Advisory GHSA-3j79-9c69-968q · GitHub Advisory Database
Cite this entry
"Malicious code in localize-translate (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-localize-translate-npm-1ox8kw
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - containedcritical
Malicious code in mutex-plus (npm)
The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in commandor-core (npm)
commandor-core@1.0.0 on npm contained malicious code in its postinstall script that downloads and executes a Windows binary (main.exe) from a typosquatted domain and beacons host information to a hardcoded IP address.
npmCompromised packageMalicious commit