GCVE-110-OSM-2026-12040

greensaver@1.2.3 declares a postinstall script ("node lib/greensaver.js") that runs automatically on `npm install`. The script decodes two files masquerading as TypeScript sourcemaps (lib/parse.ts.map and lib/init.ts.map) from base64 into sibling JavaScript files (lib/parsetmp.js and lib/config.js), requires the loader, and then unlinks all four files to erase evidence. The loader fetches an AES-CBC-encrypted blob from https://www.jsonkeeper.com/b/V6NBX (an anonymous JSON paste host), decrypts it with the hardcoded password 'myPassword123', and passes the resulting plaintext directly to eval(). The endpoint URL and auth header values are additionally base64-wrapped for a second obfuscation layer. The remainder of the package (scan.js, parse.js, constants.js, utils.js, and the exported makeRe/scan/parse API) is a rename of the picomatch glob-matcher library, providing a cover story for the dropper. The package name and 'Blazing fast and accurate glob matcher' description resemble picomatch. ENTRY index.js (main: index.js) EXFIL - System Information Collection in lib/utils.js: "process.platform" OBFUSCATION - Dynamic Base64 Decoding in lib/greensaver.js: "Buffer.from(cleanBase64, "base64")" - Strings Extracted from Deobfuscated Code in lib/greensaver.js ADDITIONAL FINDINGS - Dynamic Code Execution in lib/greensaver.js: "exec(output)" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES lib/greensaver.js (+ lib/parse.js)