{"id":"MAL-2026-15553","summary":"Malicious code in es6-migrator (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (daeec82833ba2519ba974153de0fb545f6b5c088ed2a8145680ede73c5b0b9b8)\nThe package's declared preinstall script runs beacon.js on npm install. The beacon unconditionally collects installer-side identity fields (hostname, OS username, current working directory, INIT_CWD, a derived context ID, runtime signature, and detected CI provider), base32-encodes them into custom X-Bug-Bounty-* request headers, and issues a plain-HTTP GET to a hardcoded bare-IP endpoint at http://45.76.249.245/beacon/QHHXFUL-YIB6g0kLLjMIDF_DFSRl2FdD/es6-migrator/1.0.1. If the HTTP callback fails or times out, beacon.js falls back to DNS out-of-band exfiltration, encoding each identity field into subdomains under seven preconfigured *.oob.asm5.net hosts and issuing A/AAAA/TXT/MX/CNAME/NS/SOA queries to tunnel the same data. The package's own metadata additionally identifies it as a dependency-confusion proof-of-concept targeting the name es6-migrator on the public registry, so any organization whose internal build resolves this name from the public registry is beaconed at install time. The bare-IP HTTP endpoint, the unrelated DNS-tunnel destination (asm5.net), the plain-HTTP transport, and the fallback design to defeat egress filtering are all inconsistent with any legitimate maintainer telemetry, and the 'authorized bug bounty' self-label in the package description is author-controlled and does not remove the install-time exfiltration.\n","modified":"2026-09-08T22:45:04.747416949Z","published":"2026-08-29T02:13:09Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-019134","import_time":"2026-08-29T02:22:20.443258038Z","modified_time":"2026-08-29T02:13:09Z","sha256":"daeec82833ba2519ba974153de0fb545f6b5c088ed2a8145680ede73c5b0b9b8"},{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-019721","import_time":"2026-09-08T22:37:56.737105924Z","modified_time":"2026-09-08T22:18:42Z","sha256":"785bd165852d6906e681cfb73461d8c2c264a78f451c34f8b4d06de3cba4f2e2"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/es6-migrator/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/es6-migrator/v/1.0.0"}],"affected":[{"package":{"name":"es6-migrator","ecosystem":"npm","purl":"pkg:npm/es6-migrator"},"versions":["1.0.1","1.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/es6-migrator/MAL-2026-15553.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"filename":"es6-migrator-1.0.1.tgz","hashes":{"sha512_sri":"sha512-Yaxt1XRH9YSvNNFtNj575LQNIs5m6kwD4R+U597bR53/06u/WS2bqktyxCrLC5d1L8mqvYTTalLh0oZmL+XhCw==","sha1":"8dd4c39bd6396f40c98b5ed7dabfde0443cf5033"}}],"evidence_files":[{"path":"beacon.js","sha256":"f9d83c06beffbdc8e613b191e5d07efea91c063ac5c706c54aba65417d2278ad","tlsh":"9122756191f7340117936099a51b201ab779a113380eecd4be9c43193f8ffa9d5f2aae"},{"tlsh":"dd11ab24c9248c332af851a90d75202ba9258c6b4d243d1cb3ce685c4f8ee8fa0ba17d","path":"package.json","sha256":"f81344990d29e948d71248ecab678e29ea48f1e26cee8dcfb79038f7eeba549e"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}