registry / greensaver / 1.2.3

greensaver@1.2.3

Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

Installation loads concealed JavaScript from base64 map files. That code retrieves, decrypts, and evaluates a remote payload.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm automatically runs postinstall during installation.

Impact

Allows the package publisher to run remotely supplied code in the installing user's environment.

Mechanism

Hidden remote payload loader with runtime evaluation.

Attack narrative

On installation, postinstall runs lib/greensaver.js. It decodes two disguised map files into temporary JavaScript and configuration files, then loads the temporary loader. The hidden loader fetches an encrypted response from a remote endpoint, decrypts it, and evaluates the resulting code. The installer then removes the loader, configuration, and encoded source files, concealing the chain.

AI rationale

This is a concealed install-time remote code execution chain, not functionality required for a glob matcher. The automatic execution, opaque payload retrieval, evaluation, and cleanup establish malicious intent.

Evidence

package.jsonlib/greensaver.jsnode_modules/greensaver/lib/parse.ts.mapnode_modules/greensaver/lib/init.ts.mapnode_modules/greensaver/lib/parsetmp.jsnode_modules/greensaver/lib/config.js

Network endpoints1

www.jsonkeeper.com/b/V6NBX

greensaver@1.2.3 declares a postinstall script ("node lib/greensaver.js") that runs automatically on `npm install`. The script decodes two files masquerading as TypeScript sourcemaps (lib/parse.ts.map and lib/init.ts.map) from base64 into sibling JavaScript files (lib/parsetmp.js and lib/config.js), requires the loader, and then unlinks all four files to erase evidence. The loader fetches an AES-CBC-encrypted blob from https://www.jsonkeeper.com/b/V6NBX (an anonymous JSON paste host), decrypts it with the hardcoded password 'myPassword123', and passes the resulting plaintext directly to eval(). The endpoint URL and auth header values are additionally base64-wrapped for a second obfuscation layer. The remainder of the package (scan.js, parse.js, constants.js, utils.js, and the exported makeRe/scan/parse API) is a rename of the picomatch glob-matcher library, providing a cover story for the dropper. The package name and 'Blazing fast and accurate glob matcher' description resemble picomatch.

greensaver@1.2.3

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code