Which versions of greensaver are malicious?

The following npm versions of greensaver are flagged malicious: 1.2.1, 1.2.2, 1.2.3. Treat any of these as compromised.

How do I remediate greensaver if I installed it?

Remove greensaver from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed greensaver — how do I know if it already compromised me?

If greensaver was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is greensaver part of a known attack campaign?

Yes — greensaver is associated with the IN-MAL-2026-020013, IN-MAL-2026-020014, IN-MAL-2026-020015 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find greensaver across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for greensaver (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging greensaver across your stack and pipelines.

Malicious package

greensavernpm

greensaver is a confirmed malicious npm package (MAL-2026-16138) that executes malicious code on install (malicious versions 1.2.1, 1.2.2, 1.2.3). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in greensaver (npm)

MAL-2026-16138

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall greensaver

What this malware does

[email protected] declares a postinstall script ("node lib/greensaver.js") that runs automatically on npm install. The script decodes two files masquerading as TypeScript sourcemaps (lib/parse.ts.map and lib/init.ts.map) from base64 into sibling JavaScript files (lib/parsetmp.js and lib/config.js), requires the loader, and then unlinks all four files to erase evidence. The loader fetches an AES-CBC-encrypted blob from https://www.jsonkeeper.com/b/V6NBX (an anonymous JSON paste host), decrypts it with the hardcoded password 'myPassword123', and passes the resulting plaintext directly to eval(). The endpoint URL and auth header values are additionally base64-wrapped for a second obfuscation layer. The remainder of the package (scan.js, parse.js, constants.js, utils.js, and the exported makeRe/scan/parse API) is a rename of the picomatch glob-matcher library, providing a cover story for the dropper. The package name and 'Blazing fast and accurate glob matcher' description resemble picomatch.

Malicious versions

3 flagged

1.2.11.2.21.2.3

Indicators of compromise (SHA-256)

0d9225dfc389b1b10c4faecc9587c673141ae52bddf92034efbab2e8af6381c6

dd840e550f39e1f29f7a50b0cd121c3fa5e78e99954f22009f03b5ac775f91ec

9e6037c557538871df82e7bc87a05d1e5c10a7876e9e3f2a903e1984602fc7be

Detection & response playbook

Malicious package

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for greensaver (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging greensaver across your stack and pipelines.
If you installed it — respond
Remove greensaver from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If greensaver was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks greensaver before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. greensaver on npm has been identified as a malicious package (versions 1.2.1, 1.2.2, 1.2.3 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-020013IN-MAL-2026-020014IN-MAL-2026-020015

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks greensaver-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database