MalwarePublished 10 Jul 2026Updated 25 Aug 2026

transform-es2015-sticky-regex (npm) · Malicious Code

Affects transform-es2015-sticky-regexSource GCVE Database

Malicious package : remove transform-es2015-sticky-regex and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10136

What to do

Remove transform-es2015-sticky-regex from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtransform-es2015-sticky-regex	Affected =6.24.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (eadf76ef8e123f9ce50c2910c71912996a3d079a91076ffed8d29830a1687ae1) package.json declares both a dependency and a devDependency on 'transform-es2015-sticky-regex' pointing at http://pack.nppacks.com/npm/transform-es2015-sticky-regex. On `npm install`, npm fetches whatever tarball that plain-HTTP, non-registry host currently serves and installs it into node_modules with no version pin and no integrity hash — the maintainer of pack.nppacks.com can substitute arbitrary code at any time and it will land in the installer's dependency tree on the next install. The package name is also a namespace-confusion of the well-known 'babel-plugin-transform-es2015-sticky-regex' (Babel plugin naming convention prefixes 'babel-plugin-'); the shipped index.js does not implement the sticky-regex transform but a DefinePlugin-style identifier replacer, and a source comment states the package is 'for Security Research Testing Purpose'. Additional network-capable dependencies (axios, node-fetch, ws) are declared but unused by the shipped code, pre-staging network primitives for whatever the swapped tarball chooses to import.

Impact

Installing this package version can lead to arbitrary code execution due to the ability of the remote maintainer to substitute malicious code at any time. The package's misleading name increases the risk of accidental inclusion in projects expecting the legitimate Babel plugin. The presence of network-capable dependencies suggests potential for network-based malicious activities if exploited.

Defensive guidance

Users should avoid installing 'transform-es2015-sticky-regex' version 6.24.3 from untrusted sources, especially those served over plain HTTP. Replace any usage of this package with the legitimate 'babel-plugin-transform-es2015-sticky-regex' from the official npm registry. Review and remove this package from existing projects to eliminate the risk.

Summary

The 'transform-es2015-sticky-regex' npm package at version 6.24.3 is a malicious package that abuses a non-secure HTTP source (http://pack.nppacks.com) for its tarball, enabling the remote maintainer to replace the package contents arbitrarily. This package name is a namespace confusion of the legitimate 'babel-plugin-transform-es2015-sticky-regex'. The shipped code does not perform the advertised sticky regex transform but acts as an identifier replacer with a comment indicating it is for security research testing. It also pre-stages network dependencies (axios, node-fetch, ws) which are unused but could be exploited if the package is swapped with malicious code. This creates a supply chain risk where installing this package could introduce arbitrary malicious code into a project.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 11 Jul 2026, 10:08 UTC

Technical details

References

Community reviews