transform-es2015-unicode-regex

{"modified":"2026-08-07T13:43:51Z","published":"2026-08-07T13:43:51Z","schema_version":"1.7.4","id":"MAL-2026-13612","summary":"Malicious code in transform-es2015-unicode-regex (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e85a13111400ea4b22bb2ae0d51ad784a89bc548d56b496a855bf7e6d6595804)\npackage.json declares the package's own name as a dependency (and devDependency) with the specifier http://pack.nppacks.com/npm/transform-es2015-unicode-regex, a plain-HTTP, non-registry, third-party host unrelated to the legitimate babel-plugin-transform-es2015-unicode-regex it name-resembles. When a consumer runs `npm install`, npm fetches whatever tarball that URL currently returns and installs it, running any lifecycle scripts and making the fetched code require-able — arbitrary install-time code execution controlled by the operator of pack.nppacks.com, over an unauthenticated cleartext channel that is also trivially MITM-able. The package's index.js is not the referenced Babel plugin's code and carries a self-labeled 'Security Research Testing Purpose' comment; the name mimics babel-plugin-transform-es2015-unicode-regex, increasing the chance of accidental installation.\n","affected":[{"package":{"ecosystem":"npm","name":"transform-es2015-unicode-regex"},"versions":["6.24.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"876cd68be946914049a3ac4a18bc953b5744adbea683580c94dda7159c825228","tlsh":"c601a714cd65ad1349c5a175f5e61e16952cd9470869fd4c37ca16ad0a4c1ff20f433e"},{"path":"index.js","sha256":"f2fcebdb4f0e41365a39ca87a52fcc4e6abd5633fe6272e60d1386d26b90ef41","tlsh":"71a1935ab5e0159745aa22e5b3ce48b577bd80b3330df5a0b54cbf563f40c348a1aed1"}],"package_integrity":[{"filename":"transform-es2015-unicode-regex-6.24.1.tgz","hashes":{"sha1":"80df5c272ff15d9e22cff74f8812124b4eef5d79","sha512_sri":"sha512-pn6yftW8G4r6P4K1qQCoKpRA05fxQ9nmPLarWut5/xZjjQhfdLdRfgddRAKVDZJ1jmECtkO72OgMDq9hQHVx0g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/transform-es2015-unicode-regex/v/6.24.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017082","import_time":"2026-08-07T14:26:54.495355209Z","modified_time":"2026-08-07T13:43:51Z","sha256":"e85a13111400ea4b22bb2ae0d51ad784a89bc548d56b496a855bf7e6d6595804","source":"amazon-inspector","versions":["6.24.1"]}]}}