{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "package.json",
              "sha256": "876cd68be946914049a3ac4a18bc953b5744adbea683580c94dda7159c825228",
              "tlsh": "c601a714cd65ad1349c5a175f5e61e16952cd9470869fd4c37ca16ad0a4c1ff20f433e"
            },
            {
              "path": "index.js",
              "sha256": "f2fcebdb4f0e41365a39ca87a52fcc4e6abd5633fe6272e60d1386d26b90ef41",
              "tlsh": "71a1935ab5e0159745aa22e5b3ce48b577bd80b3330df5a0b54cbf563f40c348a1aed1"
            }
          ],
          "package_integrity": [
            {
              "filename": "transform-es2015-unicode-regex-6.24.1.tgz",
              "hashes": {
                "sha1": "80df5c272ff15d9e22cff74f8812124b4eef5d79",
                "sha512_sri": "sha512-pn6yftW8G4r6P4K1qQCoKpRA05fxQ9nmPLarWut5/xZjjQhfdLdRfgddRAKVDZJ1jmECtkO72OgMDq9hQHVx0g=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "transform-es2015-unicode-regex"
      },
      "versions": [
        "6.24.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-017082",
        "import_time": "2026-08-07T14:26:54.495355209Z",
        "modified_time": "2026-08-07T13:43:51Z",
        "sha256": "e85a13111400ea4b22bb2ae0d51ad784a89bc548d56b496a855bf7e6d6595804",
        "source": "amazon-inspector",
        "versions": [
          "6.24.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e85a13111400ea4b22bb2ae0d51ad784a89bc548d56b496a855bf7e6d6595804)\npackage.json declares the package\u0027s own name as a dependency (and devDependency) with the specifier http://pack.nppacks.com/npm/transform-es2015-unicode-regex, a plain-HTTP, non-registry, third-party host unrelated to the legitimate babel-plugin-transform-es2015-unicode-regex it name-resembles. When a consumer runs `npm install`, npm fetches whatever tarball that URL currently returns and installs it, running any lifecycle scripts and making the fetched code require-able \u2014 arbitrary install-time code execution controlled by the operator of pack.nppacks.com, over an unauthenticated cleartext channel that is also trivially MITM-able. The package\u0027s index.js is not the referenced Babel plugin\u0027s code and carries a self-labeled \u0027Security Research Testing Purpose\u0027 comment; the name mimics babel-plugin-transform-es2015-unicode-regex, increasing the chance of accidental installation.\n",
  "id": "MAL-2026-13612",
  "modified": "2026-08-07T13:43:51Z",
  "published": "2026-08-07T13:43:51Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/transform-es2015-unicode-regex/v/6.24.1"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in transform-es2015-unicode-regex (npm)"
}