Malicious code in transform-es2015-unicode-regex (npm)
A malicious npm package named transform-es2015-unicode-regex was published, mimicking the legitimate babel-plugin-transform-es2015-unicode-regex. The package declared itself as a dependency pointing to an external HTTP URL (http://pack.nppacks.com/npm/transform-es2015-unicode-regex), enabling arbitrary code execution during npm install over an unauthenticated, MITM-vulnerable channel.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed transform-es2015-unicode-regex from npm during the malicious package's availability window.
- Ecosystems
- Attack vectors
- Affected entities
- transform-es2015-unicode-regexMalicious npm package mimicking babel-plugin-transform-es2015-unicode-regex
A malicious npm package named transform-es2015-unicode-regex was discovered and reported via the OpenSSF malicious-packages repository. The package name closely resembles the legitimate Babel plugin babel-plugin-transform-es2015-unicode-regex, increasing the likelihood of accidental installation by developers.
The malicious package's package.json declared itself as both a dependency and devDependency, pointing to an external HTTP URL (http://pack.nppacks.com/npm/transform-es2015-unicode-regex) rather than the official npm registry. When a consumer ran npm install, npm would fetch and execute whatever tarball was hosted at that URL, enabling arbitrary code execution at install time.
The attack exploited two critical weaknesses: (1) the use of plain HTTP without authentication, making the connection vulnerable to man-in-the-middle attacks, and (2) the typosquatting name similarity to the legitimate Babel plugin. The package's index.js contained a self-labeled 'Security Research Testing Purpose' comment, indicating it was a proof-of-concept or test package.
The incident was identified and credited to the OpenSSF's malicious-packages project, which tracks such threats in the open-source ecosystem.
Indicators of compromise
- Packages
- transform-es2015-unicode-regex
- Domains
- pack.nppacks.com
Remediation
- Audit npm install logs and dependency trees for any installation of transform-es2015-unicode-regex
- Remove the malicious package from all affected systems and environments
- Review and rotate any credentials or secrets that may have been exposed on systems where the package was installed
- Verify the integrity of all installed dependencies, particularly those with similar names to legitimate packages
- Use npm audit and security scanning tools to detect similar typosquatting or malicious packages
- Consider using npm package lock files and integrity verification to prevent unexpected package fetches
- Monitor for any suspicious network activity or code execution originating from systems where the package was installed
Sources
- GitHub Advisory GHSA-fmrp-cpm8-5245 · GitHub Advisory Database
Cite this entry
"Malicious code in transform-es2015-unicode-regex (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-transform-es2015-unicode-regex-npm-qaq50y
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in tyepescript-cli (npm)
tyepescript-cli, a typosquat of the legitimate typescript package on npm, contains malicious postinstall code that downloads and executes a Windows binary (main.exe) and beacons to an attacker-controlled server. The package uses XOR obfuscation to hide URLs, commands, and IP addresses, with special logic to target both Windows and WSL environments.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in comander-lib (npm)
comander-lib@1.0.0 is a typosquat of the legitimate `commander` package containing malicious code. The package's postinstall script exfiltrates system information to a C2 server and downloads and executes a Windows payload, with capability to escape WSL/Linux sandboxes via PowerShell.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in core-js-gns (npm)
The npm package core-js-gns contained malicious code in its postinstall hook that exfiltrated system information and executed remotely-fetched Python code on developer machines. The package name was a typosquat of the legitimate core-js library.
npmCompromised packageTyposquatting - containedcritical
Malicious code in comand (npm)
The npm package 'comand' contained malicious code that executed automatically on install via postinstall.js, exfiltrating platform information and downloading an unsigned executable (main.exe) to Windows systems or via WSL PowerShell bridges. The package name appears to be a typosquat of 'command', and the GitHub owner (braz1) does not match the npm publisher.
npmCompromised packageTyposquatting