RCE (Remote Code Execution) @babel/plugin-transform-modules-systemjs Dependency in Jira Software Data Center

This High severity RCE Remote Code Execution vulnerability was introduced in versions 9.17.2, 10.0.0, 10.1.1, 10.3.20, and 11.3.8 of Jira Software Data Center. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H...

CVE-2026-44728 Improper Control of Generation of Code when compiling specifically crafted malicious code with @babel/plugin-transform-modules-systemjs

Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and...

@2kk/miniprogram-ci (>=0.0.2, <=0.0.8), @agilejs/cli (1.0.0) +335 more potentially affected by CVE-2026-44728 via @babel/plugin-transform-modules-systemjs (>=7.12.1, <=7.29.0)

@babel/plugin-transform-modules-systemjs NPM version =7.12.1, =0.0.2, =1.0.0, =7.21.4-esm.2, =2.1.0-alpha.0, =2.1.0-alpha.0, =2.1.0-alpha.0, =2.1.0-alpha.74, =1.0.0, =1.1.5 and more Source cves: CVE-2026-44728 Source advisory: SNYK:JS-BABELPLUGINTRANSFORMMODULESSYSTEMJS-16624576...

@2kk/miniprogram-ci (>=0.0.2, <=0.0.8), @agilejs/cli (1.0.0) +335 more potentially affected by CVE-2026-44728 via @babel/plugin-transform-modules-systemjs (>=7.12.1, <=7.29.0)

@babel/plugin-transform-modules-systemjs NPM version =7.12.1, =0.0.2, =1.0.0, =7.21.4-esm.2, =2.1.0-alpha.0, =2.1.0-alpha.0, =2.1.0-alpha.0, =2.1.0-alpha.74, =1.0.0, =1.1.5 and more Source cves: CVE-2026-44728 Source advisory: OSV:GHSA-FV7C-FP4J-7GWP...

@achmadk/react-epic-spinner-css (>=0.0.1, <=0.0.3), @alphabetabc/webpack-config (>=0.0.2, <=0.0.13) +324 more potentially affected by CVE-2026-44728 via @babel/plugin-transform-modules-systemjs (8.0.1)

@babel/plugin-transform-modules-systemjs NPM version 8.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @babel/plugin-transform-modules-systemjs and may be impacted: - @achmadk/react-epic-spinner-css =0.0.1, =0.0.2, =2018.6.17-0, =2018.5.15-0,...

@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input

Impact Using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. Known affected plugins are: - @babel/plugin-transform-modules-systemjs - @babel/preset-env when using the modules: "systemjs" option, as it delegat...

Malicious code in transform-modules-systemjs (npm)

The package 'transform-modules-systemjs' is part of the PhantomRaven supply chain attack campaign Wave 3. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

MAL-2026-1571 Malicious code in transform-modules-systemjs (npm)

The package 'transform-modules-systemjs' is part of the PhantomRaven supply chain attack campaign Wave 3. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

Malicious Package

Overview transform-modules-systemjs is a malicious package. This package was recognized as part of the 'PhantomRaven' supply chain campaign, which involves credential-stealing malware. The package impersonates well-known ecosystem plugins to deceive developers into installing it. Malicious Behavi...

PT-2026-25435

Vulnerability Webhook transform modules were validated with lexical path checks only. A symlink under the allowed hooks transform tree could resolve outside the intended directory and be dynamically imported. Affected Packages / Versions - Package: openclaw npm - Affected versions: = 2026.2.21-2 ...