MAL-2026-3125

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/transform-regexp-constructors/MAL-2026-3125.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-3125
Published
2026-03-16T00:00:00Z
Modified
2026-04-30T23:06:12Z
Summary
Malicious code in transform-regexp-constructors (npm)
Details

The package 'transform-regexp-constructors' is part of the PhantomRaven supply chain attack campaign (Wave 3). It uses a Remote Dynamic Dependency (RDD) technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server (package.storeartifacts.com). During npm install, npm automatically fetches a malicious tarball from the C2. The tarball preinstall hook executes a 259-line payload that harvests developer emails from .gitconfig, .npmrc, and environment variables; collects CI/CD tokens from GitHub Actions, GitLab CI, Jenkins, and CircleCI; fingerprints the host system; and exfiltrates all data to http://package.storeartifacts.com/npm.php via redundant HTTP GET, POST, and WebSocket channels with no visible terminal output. The campaign was first disclosed by Koi Security in October 2025 (Wave 1) and extended across Waves 2-4 between November 2025 and February 2026. Full analysis: https://www.endorlabs.com/learn/return-of-phantomraven

Any developer or CI/CD system that installed this package should be considered compromised. All secrets, tokens, and credentials accessible from that environment should be rotated immediately from a separate, unaffected machine.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (fe9ae291eb7b64a00eab5a184806e56e7451b7b0d7cad6ef42a2f22f6ec8070d)

The package transform-regexp-constructors was found to contain malicious code.

Database specific 
{
    "iocs": {
        "domains": [
            "package.storeartifacts.com"
        ],
        "urls": [
            "http://package.storeartifacts.com/npm.php"
        ]
    },
    "malicious-packages-origins": [
        {
            "import_time": "2026-04-30T22:23:09.079393229Z",
            "modified_time": "2026-04-30T21:59:18Z",
            "sha256": "fe9ae291eb7b64a00eab5a184806e56e7451b7b0d7cad6ef42a2f22f6ec8070d",
            "source": "amazon-inspector",
            "versions": [
                "0.4.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / transform-regexp-constructors

Package

Name
transform-regexp-constructors
View open source insights on deps.dev
Purl
pkg:npm/transform-regexp-constructors

Affected ranges

Type
SEMVER
Events
Introduced
0.4.3

Affected versions

0.*
0.4.3

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "Embedded Malicious Code",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/transform-regexp-constructors/MAL-2026-3125.json"