greensaver@1.2.2

Analysis

greensaver is a trojanized clone of the micromatch glob library. Its preinstall and postinstall hooks run lib/greensaver.js, which decodes two base64-encoded payloads (lib/parse.ts.map and lib/init.ts.map) into temporary JS files, executes them, then deletes the artifacts. The decoded payload fetches an AES-256-CBC-encrypted session from an anonymous[.]com endpoint (authenticating with an x-service-token header), decrypts it using a key derived from the hardcoded passphrase 'myPassword123' with salt 'salt', and executes the decrypted content via eval — a remote code execution / C2 channel that runs at install time.