registry / greensaver / 1.2.1

greensaver@1.2.1

Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

Importing the package runs a concealed loader. It retrieves encrypted remote code, decrypts and evaluates it.

Static reason

No blocking static signals were detected.

Trigger

Requiring or importing greensaver through its main entry point.

Impact

An attacker controlling the remote response can execute arbitrary code in the consuming process.

Mechanism

Base64-hidden remote payload loader with decrypted eval

Attack narrative

The package entry point imports lib/greensaver.js. That file decodes hidden code from files disguised as source maps, writes temporary JavaScript and configuration files under node_modules, then imports the generated loader. Static decoding shows that loader contacts https://www.jsonkeeper.com/b/V6NBX, decrypts a returned session, and evaluates it. The original maps and generated files are then deleted, concealing the chain.

AI rationale

This is a concrete import-time remote code execution chain concealed in unrelated glob-matching code. The absence of an install hook does not mitigate execution when an application imports the package.

Evidence

lib/greensaver.js./node_modules/greensaver/lib/parse.ts.map./node_modules/greensaver/lib/init.ts.map./node_modules/greensaver/lib/parsetmp.js./node_modules/greensaver/lib/config.js

Network endpoints1

www.jsonkeeper.com/b/V6NBX

OSV advisory

greensaver@1.2.3 declares a postinstall script ("node lib/greensaver.js") that runs automatically on `npm install`. The script decodes two files masquerading as TypeScript sourcemaps (lib/parse.ts.map and lib/init.ts.map) from base64 into sibling JavaScript files (lib/parsetmp.js and lib/config.js), requires the loader, and then unlinks all four files to erase evidence. The loader fetches an AES-CBC-encrypted blob from https://www.jsonkeeper.com/b/V6NBX (an anonymous JSON paste host), decrypts it with the hardcoded password 'myPassword123', and passes the resulting plaintext directly to eval(). The endpoint URL and auth header values are additionally base64-wrapped for a second obfuscation layer. The remainder of the package (scan.js, parse.js, constants.js, utils.js, and the exported makeRe/scan/parse API) is a rename of the picomatch glob-matcher library, providing a cover story for the dropper. The package name and 'Blazing fast and accurate glob matcher' description resemble picomatch.

greensaver@1.2.1

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code