MAL-2026-16156

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/get-power/MAL-2026-16156.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16156
Published
2026-09-14T19:18:30Z
Modified
2026-09-14T19:45:05Z
Summary
Malicious code in get-power (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e261e4010770fc43fd02cf8c9add484ea5f8a92a21f60682f2aea73f0ce110f7)

get-power impersonates ljharb's get-proto utility (package.json declares author 'Jordan Harband ljharb@gmail.com' and homepage github.com/ljharb/get-power) while mirroring get-proto's file layout as cover. On require(), index.js base64-decodes two bundled files disguised as sourcemaps (parse.ts.map, init.ts.map) into parsetmp.js and config.js, require()s parsetmp.js, then fs.unlink()s all four files to erase traces. The decoded payload fetches an AES-256-CBC encrypted blob from https://www.jsonkeeper.com/b/V6NBX via axios, decrypts it with a hardcoded password/salt, and eval()s the plaintext. Whoever controls that paste has arbitrary code execution on any host that installs and loads the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020044",
            "import_time": "2026-09-14T19:37:52.829618548Z",
            "modified_time": "2026-09-14T19:18:30Z",
            "sha256": "e261e4010770fc43fd02cf8c9add484ea5f8a92a21f60682f2aea73f0ce110f7",
            "source": "amazon-inspector",
            "versions": [
                "1.0.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / get-power

Package

Name
get-power
View open source insights on deps.dev
Purl
pkg:npm/get-power

Affected ranges

Affected versions

1.*
1.0.3

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "30ce083fc334cc449dd01960e48fb616e7091ddb2c660a9b1179b93c4fcd9b05",
            "tlsh": "cf41247d27aa012b40d393d79561484e730d5ab6711ec9826d8c45622edb0ec1eefca8"
        },
        {
            "path": "package.json",
            "sha256": "9fec3ed692485e8c2f67ae49cff9ca06f39fdb0e28244f4225310ce6080191af",
            "tlsh": "76411223d669c9f306c05abcba1d54c2a6be41749890ecce8de17a71c1dd472113f78a"
        }
    ],
    "package_integrity": [
        {
            "filename": "get-power-1.0.3.tgz",
            "hashes": {
                "sha1": "811001a696d3b0cb1676e8522fa3d2d1694ca61c",
                "sha512_sri": "sha512-RtXfFpoqZ/NkMMM+xnxcC0HMuKyYRHIWcKUalWAkQtCAv6uSQ0IDeOSWjVyUkeiz1CNERA6SK6FLgtqPh+nxHA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/get-power/MAL-2026-16156.json"