transform-es2015-unicode-regex

Details

**Severity:** Critical

**Affected versions:** `= 6.24.1`

## Source: amazon-inspector (e85a13111400ea4b22bb2ae0d51ad784a89bc548d56b496a855bf7e6d6595804)
package.json declares the package's own name as a dependency (and devDependency) with the specifier http://pack.nppacks.com/npm/transform-es2015-unicode-regex, a plain-HTTP, non-registry, third-party host unrelated to the legitimate babel-plugin-transform-es2015-unicode-regex it name-resembles. When a consumer runs `npm install`, npm fetches whatever tarball that URL currently returns and installs it, running any lifecycle scripts and making the fetched code require-able — arbitrary install-time code execution controlled by the operator of pack.nppacks.com, over an unauthenticated cleartext channel that is also trivially MITM-able. The package's index.js is not the referenced Babel plugin's code and carries a self-labeled 'Security Research Testing Purpose' comment; the name mimics babel-plugin-transform-es2015-unicode-regex, increasing the chance of accidental installation.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/3332ef6b6a697786db2c1ccdfe2831f321211877/osv/malicious/npm/transform-es2015-unicode-regex/MAL-2026-13612.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/3332ef6b6a697786db2c1ccdfe2831f321211877/osv/malicious/npm/transform-es2015-unicode-regex/MAL-2026-13612.json
- https://www.npmjs.com/package/transform-es2015-unicode-regex/v/6.24.1
- https://github.com/advisories/GHSA-fmrp-cpm8-5245

Compromised versions (1)

• = 6.24.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.