Malicious code in es6-migrator (npm)

The es6-migrator package version 1.0.1 includes a preinstall script that runs beacon.js on npm install. This script collects sensitive installer-side identity information such as hostname, OS username, working directory, and CI provider details. It encodes this data and sends it via plain HTTP GET requests to a hardcoded IP address (http://45.76.249.245) and, if unsuccessful, falls back to DNS-based exfiltration using various DNS record types to the domain asm5.net. The package is identified as a dependency-confusion proof-of-concept, targeting organizations that resolve this package name from the public npm registry, resulting in unintended data leakage during installation. The exfiltration methods and endpoints are inconsistent with legitimate telemetry, and the package's self-labeling does not mitigate the malicious behavior.

Installation of es6-migrator version 1.0.1 results in unauthorized exfiltration of sensitive environment and identity information from the installer system to attacker-controlled infrastructure. This can lead to exposure of internal hostnames, usernames, directory paths, and CI environment details, potentially aiding further targeted attacks or reconnaissance. The fallback to DNS tunneling allows data exfiltration even in environments with HTTP egress filtering, increasing the risk of unnoticed data leakage.

Avoid using or installing es6-migrator version 1.0.1 from the public npm registry. Since no patch or fix is indicated, the recommended action is to remove this package from dependency lists and internal registries. Monitor for any usage of this package and replace it with trusted alternatives. There is no vendor advisory or official fix available; therefore, patch status is not yet confirmed—check vendor or registry advisories for updates. Network egress filtering should be reviewed to detect or block connections to the indicated IP and DNS domains.