Embedded Malicious Code Affecting bmc-i18n-extract-cli package, versions =1.1.1
Threat Intelligence
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-BMCI18NEXTRACTCLI-19639597
- published7 Sept 2026
- disclosed6 Sept 2026
Introduced: 6 Sep 2026
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)How to fix?
Avoid using all malicious instances of the bmc-i18n-extract-cli package.
Overview
bmc-i18n-extract-cli is a 这是一款能够自动将代码里的中文转成i18n国际化标记的命令行工具。当然，你也可以用它实现将中文语言包自动翻译成其他语言。适用于vue2、vue3和react
Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple packages maintained by ham1912. A malicious actor published tampered versions to the npm registry containing a payload that acts as a self-propagating worm by harvesting developer tokens from compromised environments and republishing newly infected packages.