registry / greensaver / 1.2.2

greensaver@1.2.2

Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

Automatic install hooks stage concealed code from base64 map files. The staged code retrieves an encrypted remote payload and evaluates it.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation runs the preinstall or postinstall hook.

Impact

A remote operator can execute arbitrary JavaScript in the installing user's environment.

Mechanism

Hidden payload staging, remote retrieval, decryption, and eval execution.

Attack narrative

During installation, the package runs lib/greensaver.js. That hook decodes JavaScript hidden in map files, writes it into the installed package, and requires it. The decoded code requests an encrypted session from a remote endpoint, decrypts it, and passes the result to eval. It then deletes the maps and generated files. This is a concealed remote-code-execution chain unrelated to glob matching.

AI rationale

The package uses automatic lifecycle hooks to stage, execute, and erase a concealed remote payload. This is concrete malicious install-hook abuse.

Evidence

package.jsonlib/greensaver.jslib/parse.ts.maplib/init.ts.mapnode_modules/greensaver/lib/parsetmp.jsnode_modules/greensaver/lib/config.js

Network endpoints1

www.jsonkeeper.com/b/V6NBX

OSV advisory

greensaver@1.2.3 declares a postinstall script ("node lib/greensaver.js") that runs automatically on `npm install`. The script decodes two files masquerading as TypeScript sourcemaps (lib/parse.ts.map and lib/init.ts.map) from base64 into sibling JavaScript files (lib/parsetmp.js and lib/config.js), requires the loader, and then unlinks all four files to erase evidence. The loader fetches an AES-CBC-encrypted blob from https://www.jsonkeeper.com/b/V6NBX (an anonymous JSON paste host), decrypts it with the hardcoded password 'myPassword123', and passes the resulting plaintext directly to eval(). The endpoint URL and auth header values are additionally base64-wrapped for a second obfuscation layer. The remainder of the package (scan.js, parse.js, constants.js, utils.js, and the exported makeRe/scan/parse API) is a rename of the picomatch glob-matcher library, providing a cover story for the dropper. The package name and 'Blazing fast and accurate glob matcher' description resemble picomatch.

greensaver@1.2.2

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code