registry / Data exfiltration / es6-migrator

es6-migrator

AUTHORIZED BUG BOUNTY TEST - controlled dependency-confusion proof by HackerOne researcher izzet for finding 8300347c-b5e1-4718-a74a-9e1f27d828dc

This report shows the evidence for es6-migrator@1.0.0. 2 of 2 known versions are blocked or flagged. The newest version, 1.0.1, is blocked. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This package performs unconsented install-time collection and network exfiltration of host identity, user identity, and install-path data. Its embedded research-purpose statements are not sufficient to make this behavior safe for upstream installation.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation invokes the preinstall lifecycle hook.

Impact

A remote operator receives identifying information and the working directory without the installer invoking a package command.

Mechanism

Install-time host, user, and path exfiltration over HTTP with DNS fallback.

Attack narrative

During npm installation, the preinstall hook runs beacon.js. The script obtains the machine host name, operating-system user name, and current working directory, encodes them, and sends them as HTTP headers to a remote callback. If that request fails, times out, or receives a non-success response, it performs DNS queries whose names contain the same encoded data. The collection occurs without an explicit package command from the installer.

AI rationale

Evidence

package.jsonbeacon.jsbeacon-config.json

Network endpoints4

45.76.249.245/beacon/Dl0X4pr0iz3pR1luglaGnut3kCyB_vft/es6-migrator/1.0.0vmjl1tkwxgoi3jamz7jvxw8py04i4twgz.oob.asm5.netvmjl1tkwxgoi3jamz7jv9yuo6xrpwhgki.oob.asm5.netvmjl1tkwxgoi3jamz7jvfjraso941aefb.oob.asm5.net

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

A preinstall hook automatically executes beacon.js during installation.
The hook collects the host name, operating-system user name, and current working directory.
It sends those values in HTTP headers to a configured remote callback.
On HTTP failure it encodes the values into DNS lookup names and resolves three external domains.

Evidence against

No child-process execution, file reads, environment-variable access, or persistence was found.
The package labels itself security research, but that claim does not remove the unconsented install-time collection.

Behavioral surface

Source

CryptoNetwork

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 2 file(s), 7.49 KB of source

Source & flagged code

3 flagged

package.jsonView file

•scripts.preinstall = node beacon.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

28"scripts": { "preinstall": "node beacon.js" }

High

Suspicious Lifecycle Evidence

A preinstall hook automatically executes beacon.js during installation.

package.jsonView on unpkg · L28

beacon.jsView file

241request.setTimeout(timeout, () => { resolveDnsFallback(attribution); request.destroy(); }); request.on("error", () => resolveDnsFallback(attribution)); request.end();

High

Ai Review Evidence

On HTTP failure it encodes the values into DNS lookup names and resolves three external domains.

beacon.jsView on unpkg · L241

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.preinstall = node beacon.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

28"scripts": { "preinstall": "node beacon.js" }

High

Suspicious Lifecycle Evidence

A preinstall hook automatically executes beacon.js during installation.

package.jsonView on unpkg · L28

beacon.jsView file

241request.setTimeout(timeout, () => { resolveDnsFallback(attribution); request.destroy(); }); request.on("error", () => resolveDnsFallback(attribution)); request.end();

High

Ai Review Evidence

On HTTP failure it encodes the values into DNS lookup names and resolves three external domains.

beacon.jsView on unpkg · L241

Findings

3 High1 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencebeacon.js

MediumNetwork

LowScripts Present

LowHigh Entropy Strings

LowNo License

Affected versions and remediation

This report applies to es6-migrator@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing es6-migrator@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-08 22:45:04.747Z (UTC).

Source advisory published: 2026-08-29 02:13:09.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

1.0.1latestMaliciousMalwareBlockPublishedAug 27, 2026, 11:38 AM 1.0.0shownMaliciousData ExfiltrationBlockPublishedAug 27, 2026, 8:20 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Behavioral surface

Source & flagged code

Related packages

Other data exfiltration packages