MAL-2026-15553

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/es6-migrator/MAL-2026-15553.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15553
Published
2026-08-29T02:13:09Z
Modified
2026-08-29T02:30:11.867692196Z
Summary
Malicious code in es6-migrator (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (daeec82833ba2519ba974153de0fb545f6b5c088ed2a8145680ede73c5b0b9b8)

The package's declared preinstall script runs beacon.js on npm install. The beacon unconditionally collects installer-side identity fields (hostname, OS username, current working directory, INITCWD, a derived context ID, runtime signature, and detected CI provider), base32-encodes them into custom X-Bug-Bounty-* request headers, and issues a plain-HTTP GET to a hardcoded bare-IP endpoint at http://45.76.249.245/beacon/QHHXFUL-YIB6g0kLLjMIDFDFSRl2FdD/es6-migrator/1.0.1. If the HTTP callback fails or times out, beacon.js falls back to DNS out-of-band exfiltration, encoding each identity field into subdomains under seven preconfigured *.oob.asm5.net hosts and issuing A/AAAA/TXT/MX/CNAME/NS/SOA queries to tunnel the same data. The package's own metadata additionally identifies it as a dependency-confusion proof-of-concept targeting the name es6-migrator on the public registry, so any organization whose internal build resolves this name from the public registry is beaconed at install time. The bare-IP HTTP endpoint, the unrelated DNS-tunnel destination (asm5.net), the plain-HTTP transport, and the fallback design to defeat egress filtering are all inconsistent with any legitimate maintainer telemetry, and the 'authorized bug bounty' self-label in the package description is author-controlled and does not remove the install-time exfiltration.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019134",
            "modified_time": "2026-08-29T02:13:09Z",
            "import_time": "2026-08-29T02:22:20.443258038Z",
            "source": "amazon-inspector",
            "sha256": "daeec82833ba2519ba974153de0fb545f6b5c088ed2a8145680ede73c5b0b9b8",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / es6-migrator

Package

Name
es6-migrator
View open source insights on deps.dev
Purl
pkg:npm/es6-migrator

Affected ranges

Affected versions

1.*
1.0.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "es6-migrator-1.0.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-Yaxt1XRH9YSvNNFtNj575LQNIs5m6kwD4R+U597bR53/06u/WS2bqktyxCrLC5d1L8mqvYTTalLh0oZmL+XhCw==",
                "sha1": "8dd4c39bd6396f40c98b5ed7dabfde0443cf5033"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "beacon.js",
            "tlsh": "9122756191f7340117936099a51b201ab779a113380eecd4be9c43193f8ffa9d5f2aae",
            "sha256": "f9d83c06beffbdc8e613b191e5d07efea91c063ac5c706c54aba65417d2278ad"
        },
        {
            "path": "package.json",
            "tlsh": "dd11ab24c9248c332af851a90d75202ba9258c6b4d243d1cb3ce685c4f8ee8fa0ba17d",
            "sha256": "f81344990d29e948d71248ecab678e29ea48f1e26cee8dcfb79038f7eeba549e"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/es6-migrator/MAL-2026-15553.json"