MAL-2026-16156
Malicious code in get-power (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (e261e4010770fc43fd02cf8c9add484ea5f8a92a21f60682f2aea73f0ce110f7) get-power impersonates ljharb's get-proto utility (package.json declares author 'Jordan Harband <ljharb@gmail.com>' and homepage github.com/ljharb/get-power) while mirroring get-proto's file layout as cover. On require(), index.js base64-decodes two bundled files disguised as sourcemaps (parse.ts.map, init.ts.map) into parsetmp.js and config.js, require()s parsetmp.js, then fs.unlink()s all four files to erase traces. The decoded payload fetches an AES-256-CBC encrypted blob from https://www.jsonkeeper.com/b/V6NBX via axios, decrypts it with a hardcoded password/salt, and eval()s the plaintext. Whoever controls that paste has arbitrary code execution on any host that installs and loads the package.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for get-power (npm). Pin to a known-safe version or switch to an alternative.