Which versions of es6-migrator are malicious?

The following npm versions of es6-migrator are flagged malicious: 1.0.0, 1.0.1. Treat any of these as compromised.

How do I remediate es6-migrator if I installed it?

es6-migrator is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed es6-migrator — how do I know if it already compromised me?

If es6-migrator was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is es6-migrator part of a known attack campaign?

Yes — es6-migrator is associated with the IN-MAL-2026-019134, IN-MAL-2026-019721 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find es6-migrator across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for es6-migrator (2 malicious versions).

Malicious package

es6-migratornpm

Advisory published Aug 29, 2026Updated Sep 8, 2026

es6-migrator is a confirmed malicious npm package (MAL-2026-15553) that steals credentials and exfiltrates sensitive data (malicious versions 1.0.0, 1.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in es6-migrator (npm)

MAL-2026-15553

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall es6-migrator

What this malware does

The package's declared preinstall script runs beacon.js on npm install. The beacon unconditionally collects installer-side identity fields (hostname, OS username, current working directory, INIT_CWD, a derived context ID, runtime signature, and detected CI provider), base32-encodes them into custom X-Bug-Bounty-* request headers, and issues a plain-HTTP GET to a hardcoded bare-IP endpoint at http://45.76.249.245/beacon/QHHXFUL-YIB6g0kLLjMIDF_DFSRl2FdD/es6-migrator/1.0.1. If the HTTP callback fails or times out, beacon.js falls back to DNS out-of-band exfiltration, encoding each identity field into subdomains under seven preconfigured *.oob.asm5.net hosts and issuing A/AAAA/TXT/MX/CNAME/NS/SOA queries to tunnel the same data. The package's own metadata additionally identifies it as a dependency-confusion proof-of-concept targeting the name es6-migrator on the public registry, so any organization whose internal build resolves this name from the public registry is beaconed at install time. The bare-IP HTTP endpoint, the unrelated DNS-tunnel destination (asm5.net), the plain-HTTP transport, and the fallback design to defeat egress filtering are all inconsistent with any legitimate maintainer telemetry, and the 'authorized bug bounty' self-label in the package description is author-controlled and does not remove the install-time exfiltration.

Malicious versions

2 flagged

1.0.01.0.1

Indicators of compromise (SHA-256)

daeec82833ba2519ba974153de0fb545f6b5c088ed2a8145680ede73c5b0b9b8

785bd165852d6906e681cfb73461d8c2c264a78f451c34f8b4d06de3cba4f2e2

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for es6-migrator (2 malicious versions).
If you installed it — respond
es6-migrator is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If es6-migrator was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. es6-migrator on npm has been identified as a malicious package (versions 1.0.0, 1.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-019134IN-MAL-2026-019721

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks es6-migrator-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database