get-power

GHSA-pjxw-c7p6-x2gq

Malicious code in get-power (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.3`

## Source: amazon-inspector (e261e4010770fc43fd02cf8c9add484ea5f8a92a21f60682f2aea73f0ce110f7)
get-power impersonates ljharb's get-proto utility (package.json declares author 'Jordan Harband <[email protected]>' and homepage github.com/ljharb/get-power) while mirroring get-proto's file layout as cover. On require(), index.js base64-decodes two bundled files disguised as sourcemaps (parse.ts.map, init.ts.map) into parsetmp.js and config.js, require()s parsetmp.js, then fs.unlink()s all four files to erase traces. The decoded payload fetches an AES-256-CBC encrypted blob from https://www.jsonkeeper.com/b/V6NBX via axios, decrypts it with a hardcoded password/salt, and eval()s the plaintext. Whoever controls that paste has arbitrary code execution on any host that installs and loads the package.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/88f09e464eb2b042184883cb51b4d85395e1cde9/osv/malicious/npm/get-power/MAL-2026-16156.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/88f09e464eb2b042184883cb51b4d85395e1cde9/osv/malicious/npm/get-power/MAL-2026-16156.json
- https://www.npmjs.com/package/get-power/v/1.0.3
- https://github.com/advisories/GHSA-pjxw-c7p6-x2gq

Compromised versions (1)

= 1.0.3

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.