next-intl@4.14.9 security report

resolveCodec() dynamically imports a module resolved from a user-supplied format.codec string. It supports both relative/absolute file paths and package specifiers resolved via createRequire. This is by design (custom codecs), but it means the package will load and execute arbitrary modules based on configuration input. In a malicious fork, this pattern could be abused, but as written the input comes from the developer's own config.

The plugin writes .d.json.ts declaration files and message catalog files (JSON/PO) into user-configured paths under the project root, and creates directories as needed. This is expected behavior for a message extraction tool but does modify files in the consuming project.

initExtractionCompiler and createMessagesDeclaration register process 'exit', 'SIGINT', 'SIGTERM' handlers and start file watchers (@parcel/watcher, fs.watch) at Next.js config load time. While this is legitimate plugin functionality, it does install global listeners and background watchers as a side effect of importing the config.

The constructor calls installExitHandlers(), which registers process-level listeners for 'exit', 'SIGINT', and 'SIGTERM' as a side effect of merely constructing an ExtractionCompiler instance. This mutates global process state and can interfere with the host application's own shutdown handling, potentially preventing or masking cleanup routines. It is a side effect on import/instantiation rather than explicit opt-in. Signal handlers are also bound to an instance method via Symbol.dispose, and repeated construction without disposal can leak listeners (though a cleanup path exists).

installExitHandlers binds this[Symbol.dispose] fresh each call in the constructor and also each time uninstallExitHandlers is invoked, using a new bound function reference. Because process.off requires the exact same function reference used in process.on, and the bound function is regenerated, there is risk that uninstall does not remove the originally registered handlers, leading to accumulating process listeners and unbounded cleanup invocations.

getFormatExtension and resolveCodec dynamically load format handlers based on config.messages.format. This is a normal pluggable format mechanism, but it could be abused if config values are attacker-controlled; no external or computed dynamic import is visible in this file.

The code reads and writes catalog message files relative to a configured project root and messages path, which is expected behavior for an i18n extraction/persister tool. No filesystem access occurs outside the package's configured extraction scope.

The class reads and writes catalog files within a configured messagesPath directory. Path construction uses path.join with locale and extension, which could theoretically allow path traversal if locale contains '..' or absolute paths, but this is a normal library operation for managing translation catalogs, not a malicious pattern.

The write method creates directories recursively and writes files. This is standard behavior for a catalog persister and is scoped to the configured messagesPath.

Uses createRequire(import.meta.url) and require$1.resolve() to dynamically resolve and load a native SWC plugin binary ('next-intl-swc-plugin-extractor') from node_modules. While this appears to be a legitimate internal function for message extraction, dynamically loading native binaries resolved at runtime is a potential supply-chain risk if the package or its dependencies are compromised.

Invokes @swc/core's transform() with experimental plugins, which executes a native plugin against arbitrary source code. This performs code transformation at extraction time, but it is expected behavior for a build-time tool and does not itself constitute malicious activity.

The module exports a function that, when called, performs file system operations and may start a file watcher. However, the function is not executed automatically on import; it must be invoked explicitly. The once wrapper ensures it runs only once per process.

The code accesses process.env['NODE_ENV'.trim()] to check the environment. While this is a common pattern, accessing environment variables can be a security concern if the values are used unsafely or exfiltrated. Here it is only used to decide whether to start a file watcher.

The code reads JSON message files and writes generated TypeScript declaration files (.d.json.ts) to the same directory. This is the intended functionality of the package (next-intl), but it does modify the file system outside the package scope by writing files based on user-provided paths.

The class installs global process event listeners for 'exit', 'SIGINT', and 'SIGTERM' that trigger disposal logic. While this is common for cleanup in CLI tools, registering global handlers at construction time can interfere with host application behavior and may be used to ensure malicious cleanup/persistence runs on process termination. It does not itself perform exfiltration, but the pattern warrants review since the extractor's behavior is unknown and disposal could contain hidden actions.

createRequire(import.meta.url) is used to resolve a module path from the package's own location. This is a standard ESM pattern but can be abused to load arbitrary modules if paths are attacker-controlled. Here the path is hardcoded ('next-intl-swc-plugin-extractor'), so risk is limited.

SWC is configured with experimental.cacheRoot set to 'node_modules/.cache/swc', writing compilation artifacts inside node_modules. This is normal for build tools but is technically file system manipulation within the project, not external exfiltration.

Uses @parcel/watcher to monitor file system changes within specified root directories, which is expected functionality for a source file watcher. No access outside configured roots or sensitive paths is observed.

Calls fs/promises.stat on event paths to determine if they are directories. Limited to paths already observed by the watcher and within scope.

The code writes a cookie to document.cookie using a computed value. This is normal for locale synchronization, but it does perform DOM manipulation which could be abused if the input is untrusted. No external data is read or exfiltrated.

The getBasePath function reads process.env._next_intl_base_path, but this is a legitimate framework configuration variable for Next.js internationalization base path handling, not credential harvesting.

Uses path.resolve() on user-provided paths and writes files to those locations without validating that they remain within the project directory.

The code writes generated .d.json.ts files adjacent to user-specified JSON message files. While this is the intended behavior of the tool, it modifies files outside the package scope based on user-provided paths.

The module exports a function that, when invoked, registers process event handlers ('exit', 'SIGINT', 'SIGTERM') and instantiates an ExtractionCompiler which calls extractAll() and process.cwd(). While this appears to be legitimate i18n extraction logic triggered conditionally during development or Next.js build, the side-effectful registration of global process handlers and use of process.cwd() could be considered a mild concern if invoked unexpectedly. No malicious intent (exfiltration, credential harvesting, dynamic code execution) is present.

The module uses fs.watch to monitor a directory and invokes a callback when a specific file changes. It does not read, write, or exfiltrate file contents, and it stays within the directory of the watched file. No network, process spawning, environment access, or dynamic code execution is present.

getNow resolves a value using the caller-provided locale property before falling back to a default. Although no explicit environment variables are read here, the pattern of passing user/caller context into a config resolver can be abused by other modules in the package to read application context. In this file alone it only reads a property from the argument, but it sits in a production server path and should be reviewed alongside getConfigNow.js/getDefaultNow.js to confirm it is not used for context leakage.

The module imports two sibling modules and immediately wires them into the default export. No top-level side effects are visible in this file, but the actual behavior depends on getConfigNow.js and getDefaultNow.js, which are not provided. If either sibling performs network, filesystem, or environment access at import time, this file will trigger it whenever the server entrypoint is loaded.

The code reads process.env._next_intl_trailing_slash to determine trailing slash behavior. This is a benign configuration flag used by Next.js internationalization, not credential harvesting or exfiltration.

The function s(n) builds a RegExp from a path template by replacing route pattern syntax with capture groups. The input originates from application route definitions, not from external attacker-controlled sources, and is not eval-like code execution.