# MAL-2026-16138: Malicious code in greensaver (npm)


- **Type:** Malicious package
- **Package:** `greensaver` (npm)
- **Published:** 11 Sep 2026

## What is MAL-2026-16138?

MAL-2026-16138 is a malicious package in greensaver, published on 11 Sep 2026. 

### Official description

greensaver@1.2.3 declares a postinstall script ("node lib/greensaver.js") that runs automatically on `npm install`. The script decodes two files masquerading as TypeScript sourcemaps (lib/parse.ts.map and lib/init.ts.map) from base64 into sibling JavaScript files (lib/parsetmp.js and lib/config.js), requires the loader, and then unlinks all four files to erase evidence. The loader fetches an AES-CBC-encrypted blob from https://www.jsonkeeper.com/b/V6NBX (an anonymous JSON paste host), decrypts it with the hardcoded password 'myPassword123', and passes the resulting plaintext directly to eval(). The endpoint URL and auth header values are additionally base64-wrapped for a second obfuscation layer. The remainder of the package (scan.js, parse.js, constants.js, utils.js, and the exported makeRe/scan/parse API) is a rename of the picomatch glob-matcher library, providing a cover story for the dropper. The package name and 'Blazing fast and accurate glob matcher' description resemble picomatch.

## What should I do about MAL-2026-16138?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-16138 is a malicious package: greensaver (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-16138/ (Markdown: https://insights.sbomify.com/MAL-2026-16138/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-16138

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-16138/
Summaries are generated and may contain mistakes; the official description above is the record.