Which versions of es6-migrator are malicious?

The following npm versions of es6-migrator are flagged malicious: 1.0.1. Treat any of these as compromised.

How do I remediate es6-migrator if I installed it?

es6-migrator is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed es6-migrator — how do I know if it already compromised me?

If es6-migrator was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is es6-migrator part of a known attack campaign?

Yes — es6-migrator is associated with the IN-MAL-2026-019134 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find es6-migrator across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for es6-migrator (version 1.0.1). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging es6-migrator across your stack and pipelines.

Malicious package

es6-migratornpm

es6-migrator is a confirmed malicious npm package (MAL-2026-15553) that steals credentials and exfiltrates sensitive data (malicious version 1.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in es6-migrator (npm)

MAL-2026-15553

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall es6-migrator

What this malware does

The package's declared preinstall script runs beacon.js on npm install. The beacon unconditionally collects installer-side identity fields (hostname, OS username, current working directory, INIT_CWD, a derived context ID, runtime signature, and detected CI provider), base32-encodes them into custom X-Bug-Bounty-* request headers, and issues a plain-HTTP GET to a hardcoded bare-IP endpoint at http://45.76.249.245/beacon/QHHXFUL-YIB6g0kLLjMIDF_DFSRl2FdD/es6-migrator/1.0.1. If the HTTP callback fails or times out, beacon.js falls back to DNS out-of-band exfiltration, encoding each identity field into subdomains under seven preconfigured *.oob.asm5.net hosts and issuing A/AAAA/TXT/MX/CNAME/NS/SOA queries to tunnel the same data. The package's own metadata additionally identifies it as a dependency-confusion proof-of-concept targeting the name es6-migrator on the public registry, so any organization whose internal build resolves this name from the public registry is beaconed at install time. The bare-IP HTTP endpoint, the unrelated DNS-tunnel destination (asm5.net), the plain-HTTP transport, and the fallback design to defeat egress filtering are all inconsistent with any legitimate maintainer telemetry, and the 'authorized bug bounty' self-label in the package description is author-controlled and does not remove the install-time exfiltration.

Malicious versions

1 flagged

1.0.1

Indicators of compromise (SHA-256)

daeec82833ba2519ba974153de0fb545f6b5c088ed2a8145680ede73c5b0b9b8

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for es6-migrator (version 1.0.1). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging es6-migrator across your stack and pipelines.
If you installed it — respond
es6-migrator is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If es6-migrator was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks es6-migrator before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. es6-migrator on npm has been identified as a malicious package (version 1.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-019134

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks es6-migrator-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database