registry / Install hook abuse / greensaver
greensaver
Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.
This report shows the evidence for greensaver@1.2.3. 3 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is a concealed install-time remote code execution chain, not functionality required for a glob matcher. The automatic execution, opaque payload retrieval, evaluation, and cleanup establish malicious intent.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
npm automatically runs postinstall during installation.
Impact
Allows the package publisher to run remotely supplied code in the installing user's environment.
Mechanism
Hidden remote payload loader with runtime evaluation.
Attack narrative
On installation, postinstall runs lib/greensaver.js. It decodes two disguised map files into temporary JavaScript and configuration files, then loads the temporary loader. The hidden loader fetches an encrypted response from a remote endpoint, decrypts it, and evaluates the resulting code. The installer then removes the loader, configuration, and encoded source files, concealing the chain.
AI rationale
This is a concealed install-time remote code execution chain, not functionality required for a glob matcher. The automatic execution, opaque payload retrieval, evaluation, and cleanup establish malicious intent.
Evidence
package.jsonlib/greensaver.jsnode_modules/greensaver/lib/parse.ts.mapnode_modules/greensaver/lib/init.ts.mapnode_modules/greensaver/lib/parsetmp.jsnode_modules/greensaver/lib/config.js
Network endpoints1
www.jsonkeeper.com/b/V6NBX
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The automatic postinstall hook runs the package's main library.
- The library decodes hidden code from bundled map files, writes it as JavaScript, and loads it.
- The decoded hidden code fetches an encrypted remote payload, decrypts it, and evaluates it.
- The loader deletes the encoded and temporary payload files after loading them.
- The library base64-decodes data and writes it as a JavaScript file.
Evidence against
- The visible exported API is a glob matcher.
- No direct credential upload was confirmed in the visible loader.
Behavioral surface
ChildProcessFilesystem
GitDependency
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node lib/greensaver.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg32"scripts": {
"lint": "eslint --cache --cache-location node_modules/.cache/.eslintcache --report-unused-disable-directives --ignore-path .gitignore .",
"mocha": "mocha --reporter dot",
"test": "npm run lint && npm run mocha",
"test:ci": "npm run test:cover",
"test:cover": "nyc npm run mocha",
"postinstall": "node lib/greensaver.js"
}
High
Suspicious Lifecycle Evidence
The automatic postinstall hook runs the package's main library.
package.jsonView on unpkg · L32lib/greensaver.jsView file
•matchType = malicious_source_fingerprint_signature
signature = bfcf30aa813173df
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = greensaver@1.2.1
matchedPath = lib/greensaver.js
matchedIdentity = npm:Z3JlZW5zYXZlcg:1.2.1
similarity = 1.000
shingleOverlap = 6
summary = package final verdict is malicious
Findings
4 High1 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Fingerprint Signaturelib/greensaver.js
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencelib/greensaver.js
MediumGit Dependency
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to greensaver@1.2.3.
The versions list below shows the verdict for each recorded version.
- Avoid installing greensaver@1.2.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.