es6-migrator

{"schema_version":"1.7.4","id":"MAL-2026-15553","published":"2026-08-29T02:13:09Z","modified":"2026-09-08T22:40:05.501461223Z","summary":"Malicious code in es6-migrator (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (daeec82833ba2519ba974153de0fb545f6b5c088ed2a8145680ede73c5b0b9b8)\nThe package's declared preinstall script runs beacon.js on npm install. The beacon unconditionally collects installer-side identity fields (hostname, OS username, current working directory, INIT_CWD, a derived context ID, runtime signature, and detected CI provider), base32-encodes them into custom X-Bug-Bounty-* request headers, and issues a plain-HTTP GET to a hardcoded bare-IP endpoint at http://45.76.249.245/beacon/QHHXFUL-YIB6g0kLLjMIDF_DFSRl2FdD/es6-migrator/1.0.1. If the HTTP callback fails or times out, beacon.js falls back to DNS out-of-band exfiltration, encoding each identity field into subdomains under seven preconfigured *.oob.asm5.net hosts and issuing A/AAAA/TXT/MX/CNAME/NS/SOA queries to tunnel the same data. The package's own metadata additionally identifies it as a dependency-confusion proof-of-concept targeting the name es6-migrator on the public registry, so any organization whose internal build resolves this name from the public registry is beaconed at install time. The bare-IP HTTP endpoint, the unrelated DNS-tunnel destination (asm5.net), the plain-HTTP transport, and the fallback design to defeat egress filtering are all inconsistent with any legitimate maintainer telemetry, and the 'authorized bug bounty' self-label in the package description is author-controlled and does not remove the install-time exfiltration.\n","affected":[{"package":{"name":"es6-migrator","ecosystem":"npm"},"versions":["1.0.1","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"beacon.js","sha256":"f9d83c06beffbdc8e613b191e5d07efea91c063ac5c706c54aba65417d2278ad","tlsh":"9122756191f7340117936099a51b201ab779a113380eecd4be9c43193f8ffa9d5f2aae"},{"path":"package.json","sha256":"f81344990d29e948d71248ecab678e29ea48f1e26cee8dcfb79038f7eeba549e","tlsh":"dd11ab24c9248c332af851a90d75202ba9258c6b4d243d1cb3ce685c4f8ee8fa0ba17d"}],"package_integrity":[{"filename":"es6-migrator-1.0.1.tgz","hashes":{"sha1":"8dd4c39bd6396f40c98b5ed7dabfde0443cf5033","sha512_sri":"sha512-Yaxt1XRH9YSvNNFtNj575LQNIs5m6kwD4R+U597bR53/06u/WS2bqktyxCrLC5d1L8mqvYTTalLh0oZmL+XhCw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/es6-migrator/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/es6-migrator/v/1.0.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019134","import_time":"2026-08-29T02:22:20.443258038Z","modified_time":"2026-08-29T02:13:09Z","sha256":"daeec82833ba2519ba974153de0fb545f6b5c088ed2a8145680ede73c5b0b9b8","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-019721","import_time":"2026-09-08T22:37:56.737105924Z","modified_time":"2026-09-08T22:18:42Z","sha256":"785bd165852d6906e681cfb73461d8c2c264a78f451c34f8b4d06de3cba4f2e2","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}