MAL-2026-16150

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/postgreesqlhelper/MAL-2026-16150.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16150
Published
2026-09-14T16:54:35Z
Modified
2026-09-14T17:30:06Z
Summary
Malicious code in postgreesqlhelper (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8956bc32d5371591e9ad2dd809c55715c24a2b4254a9713e280fb646cd1aea49)

On require() of postgreesqlhelper, index.js decodes two base64 blobs shipped as parse.ts.map and init.ts.map, writes them to parsetmp.js and config.js, require()s parsetmp.js, and then unlinks the staged files. The decoded loader performs an HTTPS GET to https://www.jsonkeeper.com/b/V6NBX (a public paste host), AES-256-CBC decrypts the response with a hardcoded password and salt, and passes the plaintext to eval() at module load — arbitrary remote code execution against any process that imports the package. Payload naming as TypeScript sourcemap files, post-load deletion of the dropped and staged files, and package name/description that impersonate the get-proto package are consistent with deliberate concealment and typosquat lure.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020034",
            "import_time": "2026-09-14T17:15:21.771213945Z",
            "modified_time": "2026-09-14T16:54:35Z",
            "sha256": "8956bc32d5371591e9ad2dd809c55715c24a2b4254a9713e280fb646cd1aea49",
            "source": "amazon-inspector",
            "versions": [
                "1.0.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / postgreesqlhelper

Package

Name
postgreesqlhelper
View open source insights on deps.dev
Purl
pkg:npm/postgreesqlhelper

Affected ranges

Affected versions

1.*
1.0.3

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "30ce083fc334cc449dd01960e48fb616e7091ddb2c660a9b1179b93c4fcd9b05",
            "tlsh": "cf41247d27aa012b40d393d79561484e730d5ab6711ec9826d8c45622edb0ec1eefca8"
        }
    ],
    "package_integrity": [
        {
            "filename": "postgreesqlhelper-1.0.3.tgz",
            "hashes": {
                "sha1": "5791ea077c00c9e0c4566f6409175520546e0d06",
                "sha512_sri": "sha512-W7/krI3M4PkaIQdVE0ino1P2e+BnFElfoM9z1Qpyr66TodzDGEJYc+ddqqIOntwCrj7V74/V0vFfy8Ktx2Cj8w=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/postgreesqlhelper/MAL-2026-16150.json"