MAL-2026-13612

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/transform-es2015-unicode-regex/MAL-2026-13612.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13612
Published
2026-08-07T13:43:51Z
Modified
2026-08-07T14:49:44.745943920Z
Summary
Malicious code in transform-es2015-unicode-regex (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e85a13111400ea4b22bb2ae0d51ad784a89bc548d56b496a855bf7e6d6595804)

package.json declares the package's own name as a dependency (and devDependency) with the specifier http://pack.nppacks.com/npm/transform-es2015-unicode-regex, a plain-HTTP, non-registry, third-party host unrelated to the legitimate babel-plugin-transform-es2015-unicode-regex it name-resembles. When a consumer runs npm install, npm fetches whatever tarball that URL currently returns and installs it, running any lifecycle scripts and making the fetched code require-able — arbitrary install-time code execution controlled by the operator of pack.nppacks.com, over an unauthenticated cleartext channel that is also trivially MITM-able. The package's index.js is not the referenced Babel plugin's code and carries a self-labeled 'Security Research Testing Purpose' comment; the name mimics babel-plugin-transform-es2015-unicode-regex, increasing the chance of accidental installation.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017082",
            "import_time": "2026-08-07T14:26:54.495355209Z",
            "sha256": "e85a13111400ea4b22bb2ae0d51ad784a89bc548d56b496a855bf7e6d6595804",
            "modified_time": "2026-08-07T13:43:51Z",
            "versions": [
                "6.24.1"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / transform-es2015-unicode-regex

Package

Name
transform-es2015-unicode-regex
View open source insights on deps.dev
Purl
pkg:npm/transform-es2015-unicode-regex

Affected ranges

Affected versions

6.*
6.24.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-pn6yftW8G4r6P4K1qQCoKpRA05fxQ9nmPLarWut5/xZjjQhfdLdRfgddRAKVDZJ1jmECtkO72OgMDq9hQHVx0g==",
                "sha1": "80df5c272ff15d9e22cff74f8812124b4eef5d79"
            },
            "filename": "transform-es2015-unicode-regex-6.24.1.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "876cd68be946914049a3ac4a18bc953b5744adbea683580c94dda7159c825228",
            "tlsh": "c601a714cd65ad1349c5a175f5e61e16952cd9470869fd4c37ca16ad0a4c1ff20f433e"
        },
        {
            "sha256": "f2fcebdb4f0e41365a39ca87a52fcc4e6abd5633fe6272e60d1386d26b90ef41",
            "path": "index.js",
            "tlsh": "71a1935ab5e0159745aa22e5b3ce48b577bd80b3330df5a0b54cbf563f40c348a1aed1"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/transform-es2015-unicode-regex/MAL-2026-13612.json"