MAL-2026-13612

    Dashboard / Malicious Package / MAL-2026-13612

    MAL-2026-13612

    Published: 7 Aug 2026Last Modified: 7 Aug 2026

    Summary: Malicious code in transform-es2015-unicode-regex (npm)

    Details: Source: amazon-inspector (e85a13111400ea4b22bb2ae0d51ad784a89bc548d56b496a855bf7e6d6595804) package.json declares the package's own name as a dependency (and devDependency) with the specifier http://pack.nppacks.com/npm/transform-es2015-unicode-regex, a plain-HTTP, non-registry, third-party host unrelated to the legitimate babel-plugin-transform-es2015-unicode-regex it name-resembles. When a consumer runs `npm install`, npm fetches whatever tarball that URL currently returns and installs it, running any lifecycle scripts and making the fetched code require-able — arbitrary install-time code execution controlled by the operator of pack.nppacks.com, over an unauthenticated cleartext channel that is also trivially MITM-able. The package's index.js is not the referenced Babel plugin's code and carries a self-labeled 'Security Research Testing Purpose' comment; the name mimics babel-plugin-transform-es2015-unicode-regex, increasing the chance of accidental installation.

    References: https://www.npmjs.com/package/transform-es2015-unicode-regex/v/6.24.1

    Affected packages

    Package

    Name: transform-es2015-unicode-regex

    Purl: pkg:npm/transform-es2015-unicode-regex

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    6.24.1
    MAL-2026-13612 | CVE-DB