MAL-2026-16150

    Dashboard / Malicious Package / MAL-2026-16150

    MAL-2026-16150

    Published: 14 Sept 2026Last Modified: 14 Sept 2026

    Summary: Malicious code in postgreesqlhelper (npm)

    Details: Source: amazon-inspector (8956bc32d5371591e9ad2dd809c55715c24a2b4254a9713e280fb646cd1aea49) On require() of postgreesqlhelper, index.js decodes two base64 blobs shipped as parse.ts.map and init.ts.map, writes them to parsetmp.js and config.js, require()s parsetmp.js, and then unlinks the staged files. The decoded loader performs an HTTPS GET to https://www.jsonkeeper.com/b/V6NBX (a public paste host), AES-256-CBC decrypts the response with a hardcoded password and salt, and passes the plaintext to eval() at module load — arbitrary remote code execution against any process that imports the package. Payload naming as TypeScript sourcemap files, post-load deletion of the dropped and staged files, and package name/description that impersonate the get-proto package are consistent with deliberate concealment and typosquat lure.

    References: https://www.npmjs.com/package/postgreesqlhelper/v/1.0.3

    Affected packages

    Package

    Name: postgreesqlhelper

    Purl: pkg:npm/postgreesqlhelper

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.3