{"id":"MAL-2026-16463","revision":null,"records":[{"revision":"109752381b4047f79911cc2b7459c88b","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-16463","aliases":[],"title":"Malicious code in godzzz (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (39f05673527822a16dc88d65a9ff9471548f8046fc28c7930fd8958dbcc38f3a)\nThe npm package godzzz@1.0.0 ships cdp_inject.js which imports http, https, child_process and fs at the top of the file, reads process.env (including process.env.USER), reads files from disk via fs.readFileSync/fs.existsSync, base64-encodes payloads via toString('base64'), and issues outbound network calls via https.request, http.get and POST. The combination of installer-side environment and filesystem reads, base64 encoding of the resulting data, and outbound HTTP/HTTPS in a single small script matches the shape of a host-info / credential exfiltration stager rather than a legitimate library.\n","state":0,"publishedAt":"2026-09-23T04:48:38+00:00","modifiedAt":"2026-09-23T05:30:08.5369345+00:00","affected":[{"ecosystem":"npm","name":"godzzz","ranges":[],"versions":["1.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/godzzz/v/1.0.0"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-16463","license":"OSV · upstream source license applies","key":"osv:MAL-2026-16463","identifiers":["MAL-2026-16463"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T19:18:40.2432846+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T19:18:40.2432846+00:00","lastSuccessAt":"2026-11-12T19:18:40.4588707+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:18:40.458871+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-71a71be06903c0321f16f785da414a43cf171b11fafd14dad0e93850c58a221f","complete":true,"records":424812,"lastAttemptAt":"2026-11-12T19:16:36.4552812+00:00","lastSuccessAt":"2026-11-12T19:16:36.099661+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:16:36.4552812+00:00","snapshotPublishedAt":"2026-11-12T18:25:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-92f81c09e13d462186b63ad6d42bf56c","complete":true,"records":13775,"lastAttemptAt":"2026-11-12T19:19:06.4872466+00:00","lastSuccessAt":"2026-11-12T19:19:06.482+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:19:06.482+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13828,"expectedIdentifiers":13828,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T19:18:40.2432846+00:00","complete":true,"records":1123,"lastAttemptAt":"2026-11-12T19:18:40.2432846+00:00","lastSuccessAt":"2026-11-12T19:18:40.459652+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:18:40.4596522+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-5542c4cfe5304160aa85412ba73639c8","complete":true,"records":13775,"lastAttemptAt":"2026-11-12T19:19:05.6096222+00:00","lastSuccessAt":"2026-11-12T19:19:05.605+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:19:05.605+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13828,"expectedIdentifiers":13828,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0a16b7a0ad9e3cbe2c8193b3ff308e03491784410561da4c005974a7742a693a","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T19:18:40.1037842+00:00","lastSuccessAt":"2026-11-12T19:18:39.7950995+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:18:40.1037842+00:00","snapshotPublishedAt":"2026-11-12T18:33:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-4d60731753a2f72e455d1086e7203d0ef10843936dcc1cf2b45135e2caa204b0","complete":true,"records":2012,"lastAttemptAt":"2026-11-12T19:16:36.615069+00:00","lastSuccessAt":"2026-11-12T18:16:50.7862525+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:16:36.615069+00:00","snapshotPublishedAt":"2026-11-12T17:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-0d57668ba92a2918d0664e89ea91d467f8e6a2bc6330923eb883b74ac42a14ec","complete":true,"records":3125,"lastAttemptAt":"2026-11-12T19:18:40.2048041+00:00","lastSuccessAt":"2026-11-12T15:18:36.6112732+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:18:40.2048041+00:00","snapshotPublishedAt":"2026-11-12T14:48:37+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-558c98a923b6de17949b5b6cab024e22e2f0e3b948d91b9ed9bca029f7b91e19","complete":true,"records":231722,"lastAttemptAt":"2026-11-12T19:18:30.8566334+00:00","lastSuccessAt":"2026-11-12T19:18:29.2862915+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:18:30.8566334+00:00","snapshotPublishedAt":"2026-11-12T18:33:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}