Encyclopedia
npm◆ MEDIUMslopsquat⚠ ACTIVE THREAT

vue-i18n-loader

First seen: May 1, 2026 0 viewsMimics: vue-i18n
Share threatHN
Threat Description

A hallucinated i18n loader for Vue. Sounds like an official Vue ecosystem package but is not published by the vue-i18n maintainers. Registered copies include a runtime hook that reads localStorage and any window-injected config, bundling them into an outbound beacon on app mount.

AI Hallucination Analysis
Very Likely AI Hallucination75%
Known to be hallucinated by: GPT-4, Copilot
Remediation Guide
  1. Replace vue-i18n-loader with the official vue-i18n and its build plugins. 2. Review what your app stores in localStorage and rotate any sensitive values. 3. Audit network traffic for unexpected beacons on mount. 4. Add the package to your blocklist.
View on registry
Quick Facts
Ecosystem
npm
Risk Level
MEDIUM
Type
slopsquat
Status
ACTIVE
Legitimate Package
vue-i18n
Hallucination Confidence
75%
Check My Project
Scan for this package