MAL-2026-15553 Malicious code in es6-migrator (npm)

The package's declared preinstall script runs beacon.js on npm install. The beacon unconditionally collects installer-side identity fields (hostname, OS username, current working directory, INIT_CWD, a derived context ID, runtime signature, and detected CI provider), base32-encodes them into custom X-Bug-Bounty-* request headers, and issues a plain-HTTP GET to a hardcoded bare-IP endpoint at http://45.76.249.245/beacon/QHHXFUL-YIB6g0kLLjMIDF_DFSRl2FdD/es6-migrator/1.0.1. If the HTTP callback fails or times out, beacon.js falls back to DNS out-of-band exfiltration, encoding each identity field into subdomains under seven preconfigured *.oob.asm5.net hosts and issuing A/AAAA/TXT/MX/CNAME/NS/SOA queries to tunnel the same data. The package's own metadata additionally identifies it as a dependency-confusion proof-of-concept targeting the name es6-migrator on the public registry, so any organization whose internal build resolves this name from the public registry is beaconed at install time. The bare-IP HTTP endpoint, the unrelated DNS-tunnel destination (asm5.net), the plain-HTTP transport, and the fallback design to defeat egress filtering are all inconsistent with any legitimate maintainer telemetry, and the 'authorized bug bounty' self-label in the package description is author-controlled and does not remove the install-time exfiltration.