Which versions of require-i18next are malicious?

The following npm versions of require-i18next are flagged malicious: 20.0.0, 21.0.0. Treat any of these as compromised.

How do I remediate require-i18next if I installed it?

require-i18next is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed require-i18next — how do I know if it already compromised me?

If require-i18next was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is require-i18next part of a known attack campaign?

Yes — require-i18next is associated with the IN-MAL-2026-017935, IN-MAL-2026-017934 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find require-i18next across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for require-i18next (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging require-i18next across your stack and pipelines.

Malicious package

require-i18nextnpm

require-i18next is a confirmed malicious npm package (MAL-2026-14052) that steals credentials and exfiltrates sensitive data (malicious versions 20.0.0, 21.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in require-i18next (npm)

MAL-2026-14052

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall require-i18next

What this malware does

The package's preinstall.js reads a hex-encoded command string from preinstall.json, decodes it with Buffer.from(hex, 'hex'), and passes the result to child_process.exec during npm install. The decoded payload is a curl command that POSTs the installer's whoami, current working directory, hostname, and the contents of /etc/passwd to https://eousft8gflamm91.m.pipedream.net. The name resembles the legitimate i18next ecosystem but the package's only observed behavior is install-time data exfiltration to an attacker-controlled Pipedream webhook, with the payload obfuscated as hex in a sibling JSON file to evade inspection of the JS.

The OpenSSF Package Analysis project identified 'require-i18next' @ 20.0.0 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.
The package executes one or more commands associated with malicious behavior.

Malicious versions

2 flagged

20.0.021.0.0

Indicators of compromise (SHA-256)

6ea984228059ea2f54b4cb42d16a5f3f42f3144902c418be08c5000576de58f1

6120fb66e65a0dd5620f99a5777f86a7ca2ca08224e3dce45496a548f2236c96

5b5f50249e747ea23b84fdc6baa2202e9d786a872fd7d9a545017dc6fc5ad788

e4efe52810a54d3c81c562901f32694f44ad9f14e2783140499358ab014969e1

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for require-i18next (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging require-i18next across your stack and pipelines.
If you installed it — respond
require-i18next is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If require-i18next was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks require-i18next before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. require-i18next on npm has been identified as a malicious package (versions 20.0.0, 21.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-017935IN-MAL-2026-017934

References

Credits

Amazon Inspector · finder
OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks require-i18next-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database