{"id":"MAL-2026-17315","kind":"package","aliases":["MAL-2026-17315"],"related":[],"title":"Malicious code in godsplan (npm)","description":"Running the godsplan 3.0.2 CLI connects to Chrome's debugging port (9222) and injects JavaScript into every open page. It bypasses Content Security Policy and intercepts selected test-page requests. When triggered by a mouse gesture or keyboard shortcut, the injected script collects the page text and current editor input; the CLI sends that content to https://ai-script.test0ing7.workers.dev/ for AI-generated answers and inserts the response into the page. The package also disables TLS certificate verification with NODE_TLS_REJECT_UNAUTHORIZED=0. This behavior can disclose browser-page and editor contents to an external service and alter test-page content. The observed trigger is CLI execution; no install-time execution was identified.\n\nEvidence: package/cdp_inject.js:2 disables TLS verification; lines 150-180 collect page and editor content; lines 252-282 send the content to the external endpoint; lines 330-350 connect to Chrome, bypass CSP and inject the script; lines 370-390 forward the collected content. Static review of the published npm tarball (sha256 8627139afbb193624535de0c32348e7b2747449ed9940f9c29e4dfb5a3f9a350); the package was not executed during manual review.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (05dc2e058b489230e57e20471e55ae2f1e2d453f25a759ea5742f340eec85d0a)\nWhen invoked via its bin entry, the package connects to a local Chrome DevTools endpoint, extracts the active page's innerText and editor contents from the user's browser, and POSTs that payload to a hardcoded destination at https://ai-script.test0ing7.workers.dev/ using an author-embedded Groq API key from an in-source keyPool. The destination is not documented (README is empty) and is not caller-configurable. cdp_inject.js also sets process.env.NODE_TLS_REJECT_UNAUTHORIZED='0' at startup, disabling certificate verification for all HTTPS traffic in the Node process. The shipped Groq key (gsk_752HSU9TDJ3n...) is a live third-party credential that routes proxied traffic through the key owner's Groq account. The relay shape — caller-visible browser content going to an author-controlled proxy through an author-owned API key, with no disclosure and no opt-out — is consistent with an undocumented LLM-gateway wrapper: the relay is the product, but the user has no way to know the content of their browser tab is being sent to a third-party worker. No installer secrets are read (no ~/.aws, ~/.ssh, ~/.npmrc, env scraping), no install-time or import-time execution occurs (behavior is gated on the user running the bin CLI against a locally-launched Chrome DevTools session), and no persistence or remote code fetch is present.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"godsplan","fixed":[],"affected":"= 3.0.2","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-28T10:09:05+00:00","first_seen_at":"2026-10-29T14:24:37+00:00","triaged_at":"2026-10-29T14:25:47+00:00","updated_at":"2026-10-29T14:25:47+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-17315':8A,11A '-180':139C '-2026':7A,10A '-282':147C '-350':157C '-390':169C '/.aws':390C '/.npmrc':392C '/.ssh':391C '0':97C,279C '05dc2e058b489230e57e20471e55ae2f1e2d453f25a759ea5742f340eec85d0a':204C '150':138C '2':133C '252':146C '3.0.2':18C '330':156C '370':168C '752hsu9tdj3n':298C '8627139afbb193624535de0c32348e7b2747449ed9940f9c29e4dfb5a3f9a350':182C '9222':26C 'account':316C 'activ':222C 'ai':75C 'ai-gener':74C 'ai-script.test0ing7.workers.dev':72C,243C 'also':87C,273C 'alter':113C 'amazon':202C 'amazon-inspector':201C 'answer':77C 'api':250C,337C 'author':247C,329C,335C 'author-control':328C 'author-embed':246C 'author-own':334C 'behavior':99C,405C 'bin':209C,413C 'browser':103C,233C,323C,373C 'browser-pag':102C 'bypass':35C,161C 'caller':270C,321C 'caller-configur':269C 'caller-vis':320C 'cdp_inject.js':272C 'certif':90C,283C 'chrome':22C,160C,217C,420C 'cli':19C,67C,122C,414C 'code':2A,428C 'collect':58C,140C,172C 'configur':271C 'connect':20C,158C,213C 'consist':348C 'content':36C,70C,107C,117C,144C,150C,173C,228C,324C,370C 'control':330C 'credenti':305C 'csp':162C 'current':63C 'debug':24C 'destin':241C,259C 'detail':193C 'devtool':218C,421C 'disabl':88C,134C,282C 'disclos':101C 'disclosur':341C 'document':262C 'edit':196C 'editor':64C,106C,143C,227C 'embed':248C 'empti':265C 'endpoint':154C,219C 'entri':210C 'env':393C 'everi':31C 'evid':131C 'execut':123C,128C,187C,403C 'extern':110C,153C 'extract':220C 'fetch':429C 'forward':170C 'gate':407C 'gateway':354C 'generat':76C 'gestur':51C 'go':325C 'godsplan':4A,12A,17C 'groq':249C,295C,315C 'gsk':297C 'hardcod':240C 'https':287C 'identifi':130C 'import':401C 'import-tim':400C 'in-sourc':254C 'inject':28C,56C,164C 'innertext':225C 'input':65C 'insert':79C 'inspector':203C 'instal':126C,385C,397C 'install-tim':125C,396C 'intercept':40C 'invok':206C 'javascript':29C 'key':251C,296C,312C,338C 'keyboard':53C 'keypool':257C 'know':368C 'launch':419C 'line':137C,145C,155C,167C,199C 'live':301C 'llm':353C 'llm-gateway':352C 'local':216C,418C 'locally-launch':417C 'mal':6A,9A 'malici':1A,13B 'manual':189C 'mous':50C 'node':93C,291C 'npm':5A,179C 'observ':119C 'occur':404C 'open':32C 'opt':345C 'opt-out':344C 'own':336C 'owner':313C 'packag':14B,86C,184C,212C 'package/cdp_inject.js':132C 'page':33C,44C,60C,84C,104C,116C,141C,223C 'parti':304C,382C 'payload':237C 'per':191C 'persist':425C 'polici':38C 'port':25C 'post':235C 'present':431C 'process':292C 'process.env.node':275C 'product':360C 'proxi':308C,331C 'publish':178C 'read':388C 'readm':263C 'reject':95C,277C 'relay':318C,357C 'remot':427C 'request':45C 'respons':81C 'review':175C,190C 'rout':307C 'run':15C,411C 'scrape':394C 'script':57C,166C 'secret':386C 'secur':37C 'select':41C 'send':68C,148C 'sent':377C 'servic':111C 'session':422C 'set':274C 'sha256':181C 'shape':319C 'ship':294C 'shortcut':54C 'sourc':192C,200C,256C 'startup':281C 'static':174C 'tab':374C 'tarbal':180C 'test':43C,115C 'test-pag':42C,114C 'text':61C 'third':303C,381C 'third-parti':302C,380C 'time':127C,398C,402C 'tls':89C,94C,135C,276C 'traffic':288C,309C 'trigger':47C,120C 'unauthor':96C,278C 'undocu':351C 'use':244C 'user':231C,363C,410C 'verif':91C,136C,284C 'via':207C 'visibl':322C 'way':366C 'worker':383C 'wrapper':355C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-09-28T10:09:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17315","url":"https://osv.dev/vulnerability/MAL-2026-17315","severity":"critical","published_at":"2026-09-28T10:09:05+00:00","modified_at":"2026-10-29T13:48:10+00:00","first_seen_at":"2026-10-29T14:24:37+00:00","fetched_at":"2026-10-29T14:24:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}