Supply chain · npm · High

Critical Malware Alert: npm's babel-eslint-parser-legacy Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-07-10

The npm package `babel-eslint-parser-legacy` has been identified as malicious, leading to full system compromise upon installation. Organizations using this package should consider affected systems fully compromised and prioritize immediate remediation to prevent credential and secret theft.

  • Package: npm / babel-eslint-parser-legacy
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~27/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The `babel-eslint-parser-legacy` npm package contains malware. Installation of this package results in a full compromise of the host system, granting an outside entity control and enabling credential/secret theft.

How the attack works

This is a malicious package attack where a seemingly legitimate software component is embedded with harmful code. When integrated into a project and installed, the malicious code executes, establishing unauthorized access and control over the host system. This class of attack often targets development environments or CI/CD pipelines.

Who's exposed

Profiles most at risk

  • Development teams using npm for JavaScript projects
  • Organizations with CI/CD pipelines that pull npm packages
  • Any team that has `babel-eslint-parser-legacy` as a direct or transitive dependency

Conditions that increase exposure

  • Unpinned dependencies that allow fetching the latest (malicious) version
  • Lack of package lockfiles (e.g., `package-lock.json`) to ensure consistent dependency versions
  • Use of internal package mirrors that do not vet upstream packages for malicious content

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to further network penetration.
  • All secrets, keys, and sensitive data stored on the compromised computer are exposed and can be exfiltrated.
  • Compromised developer workstations or build servers can be used as a pivot point for broader supply chain attacks.

What to do (defensive)

Detect

  • Scan `package.json` and `package-lock.json` files for the presence of `babel-eslint-parser-legacy`.
  • Review dependency trees using `npm list babel-eslint-parser-legacy` to identify direct and transitive usage.
  • Monitor network traffic for unusual outbound connections from systems where this package might be installed.

Contain

  • Immediately isolate any system identified with `babel-eslint-parser-legacy` installed from the network.
  • Suspend any CI/CD pipelines or build processes that may be pulling this package.
  • Block `babel-eslint-parser-legacy` from being downloaded from npm registries or internal mirrors.

Remediate

  • Consider any system that installed `babel-eslint-parser-legacy` as fully compromised and rebuild it from a trusted image.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from the compromised computer, using a different, trusted system.
  • Remove the `babel-eslint-parser-legacy` package from all project dependencies and ensure it is not reintroduced.

Frontier verdict — High

This critical npm package compromise requires immediate system isolation, credential rotation, and rebuilding of affected systems to mitigate full control and secret theft.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.