MAL-2026-16138

    Dashboard / Malicious Package / MAL-2026-16138

    MAL-2026-16138

    Published: 11 Sept 2026Last Modified: 11 Sept 2026

    Summary: Malicious code in greensaver (npm)

    Details: Source: amazon-inspector (dd840e550f39e1f29f7a50b0cd121c3fa5e78e99954f22009f03b5ac775f91ec) [email protected] declares a postinstall script ("node lib/greensaver.js") that runs automatically on `npm install`. The script decodes two files masquerading as TypeScript sourcemaps (lib/parse.ts.map and lib/init.ts.map) from base64 into sibling JavaScript files (lib/parsetmp.js and lib/config.js), requires the loader, and then unlinks all four files to erase evidence. The loader fetches an AES-CBC-encrypted blob from https://www.jsonkeeper.com/b/V6NBX (an anonymous JSON paste host), decrypts it with the hardcoded password 'myPassword123', and passes the resulting plaintext directly to eval(). The endpoint URL and auth header values are additionally base64-wrapped for a second obfuscation layer. The remainder of the package (scan.js, parse.js, constants.js, utils.js, and the exported makeRe/scan/parse API) is a rename of the picomatch glob-matcher library, providing a cover story for the dropper. The package name and 'Blazing fast and accurate glob matcher' description resemble picomatch.

    References: https://www.npmjs.com/package/greensaver/v/1.2.1, https://www.npmjs.com/package/greensaver/v/1.2.3, https://www.npmjs.com/package/greensaver/v/1.2.2

    Affected packages

    Package

    Name: greensaver

    Purl: pkg:npm/greensaver

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.2.1
    1.2.3
    1.2.2