greensaver (npm) · Malicious Code
Affects greensaverSource GCVE Database
Malicious package : remove greensaver and rotate any secrets on hosts that installed it.
Data as of 14 Sep 2026, 00:46 UTC
Malicious package
Published to npm · OSV MAL-2026-16138
What to do
Remove greensaver from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmgreensaver | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (dd840e550f39e1f29f7a50b0cd121c3fa5e78e99954f22009f03b5ac775f91ec) greensaver@1.2.3 declares a postinstall script ("node lib/greensaver.js") that runs automatically on `npm install`. The script decodes two files masquerading as TypeScript sourcemaps (lib/parse.ts.map and lib/init.ts.map) from base64 into sibling JavaScript files (lib/parsetmp.js and lib/config.js), requires the loader, and then unlinks all four files to erase evidence. The loader fetches an AES-CBC-encrypted blob from https://www.jsonkeeper.com/b/V6NBX (an anonymous JSON paste host), decrypts it with the hardcoded password 'myPassword123', and passes the resulting plaintext directly to eval(). The endpoint URL and auth header values are additionally base64-wrapped for a second obfuscation layer. The remainder of the package (scan.js, parse.js, constants.js, utils.js, and the exported makeRe/scan/parse API) is a rename of the picomatch glob-matcher library, providing a cover story for the dropper. The package name and 'Blazing fast and accurate glob matcher' description resemble picomatch.