modern-localization@1.2.1

Analysis

On server-side import, this "localization helper" automatically fetches a remote payload and executes it. The package's syncLanguageSystem() function issues an HTTP GET to hxxps://api[.]jsonbin[.]io/v3/b/6a764665da38895dfec7cd5d (a JSON-paste storage host) with an X-Secret-Key header, reads the value from the response, and runs it as arbitrary JavaScript via new Function("require", payload) and by writing it to a temp file and forking a child process to execute it. The fetched payload is fully attacker-controlled, so the package executes arbitrary remote code on any server that imports it. A second staging URL (hxxps://api[.]jsonbin[.]io/v3/b/6a718a58da38895dfeb6e2ed) is also present. The fetch retries up to 5 times.