get-power@1.0.3

Summary

get-power impersonates ljharb's get-proto utility (package.json declares author 'Jordan Harband <ljharb@gmail.com>' and homepage github.com/ljharb/get-power) while mirroring get-proto's file layout as cover. On require(), index.js base64-decodes two bundled files disguised as sourcemaps (parse.ts.map, init.ts.map) into parsetmp.js and config.js, require()s parsetmp.js, then fs.unlink()s all four files to erase traces. The decoded payload fetches an AES-256-CBC encrypted blob from https://www.jsonkeeper.com/b/V6NBX via axios, decrypts it with a hardcoded password/salt, and eval()s the plaintext. Whoever controls that paste has arbitrary code execution on any host that installs and loads the package.

Source: amazon-inspector (e261e4010770fc43fd02cf8c9add484ea5f8a92a21f60682f2aea73f0ce110f7)