{"id":"MAL-2026-16156","summary":"Malicious code in get-power (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e261e4010770fc43fd02cf8c9add484ea5f8a92a21f60682f2aea73f0ce110f7)\nget-power impersonates ljharb's get-proto utility (package.json declares author 'Jordan Harband \u003cljharb@gmail.com\u003e' and homepage github.com/ljharb/get-power) while mirroring get-proto's file layout as cover. On require(), index.js base64-decodes two bundled files disguised as sourcemaps (parse.ts.map, init.ts.map) into parsetmp.js and config.js, require()s parsetmp.js, then fs.unlink()s all four files to erase traces. The decoded payload fetches an AES-256-CBC encrypted blob from https://www.jsonkeeper.com/b/V6NBX via axios, decrypts it with a hardcoded password/salt, and eval()s the plaintext. Whoever controls that paste has arbitrary code execution on any host that installs and loads the package.\n","modified":"2026-09-14T19:45:05.121124354Z","published":"2026-09-14T19:18:30Z","database_specific":{"malicious-packages-origins":[{"versions":["1.0.3"],"id":"IN-MAL-2026-020044","import_time":"2026-09-14T19:37:52.829618548Z","modified_time":"2026-09-14T19:18:30Z","sha256":"e261e4010770fc43fd02cf8c9add484ea5f8a92a21f60682f2aea73f0ce110f7","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/get-power/v/1.0.3"}],"affected":[{"package":{"name":"get-power","ecosystem":"npm","purl":"pkg:npm/get-power"},"versions":["1.0.3"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"sha256":"30ce083fc334cc449dd01960e48fb616e7091ddb2c660a9b1179b93c4fcd9b05","tlsh":"cf41247d27aa012b40d393d79561484e730d5ab6711ec9826d8c45622edb0ec1eefca8","path":"index.js"},{"path":"package.json","sha256":"9fec3ed692485e8c2f67ae49cff9ca06f39fdb0e28244f4225310ce6080191af","tlsh":"76411223d669c9f306c05abcba1d54c2a6be41749890ecce8de17a71c1dd472113f78a"}],"package_integrity":[{"hashes":{"sha1":"811001a696d3b0cb1676e8522fa3d2d1694ca61c","sha512_sri":"sha512-RtXfFpoqZ/NkMMM+xnxcC0HMuKyYRHIWcKUalWAkQtCAv6uSQ0IDeOSWjVyUkeiz1CNERA6SK6FLgtqPh+nxHA=="},"filename":"get-power-1.0.3.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/get-power/MAL-2026-16156.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}