Malicious code in godsplan (npm)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Running the godsplan 3.0.2 CLI connects to Chrome's debugging port (9222) and injects JavaScript into every open page. It bypasses Content Security Policy and intercepts selected test-page requests. When triggered by a mouse gesture or keyboard shortcut, the injected script collects the page text and current editor input; the CLI sends that content to https://ai-script.test0ing7.workers.dev/ for AI-generated answers and inserts the response into the page. The package also disables TLS certificate verification with NODE_TLS_REJECT_UNAUTHORIZED=0. This behavior can disclose browser-page and editor contents to an external service and alter test-page content. The observed trigger is CLI execution; no install-time execution was identified. Evidence: package/cdp_inject.js:2 disables TLS verification; lines 150-180 collect page and editor content; lines 252-282 send the content to the external endpoint; lines 330-350 connect to Chrome, bypass CSP and inject the script; lines 370-390 forward the collected content. Static review of the published npm tarball (sha256 8627139afbb193624535de0c32348e7b2747449ed9940f9c29e4dfb5a3f9a350); the package was not executed during manual review. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (05dc2e058b489230e57e20471e55ae2f1e2d453f25a759ea5742f340eec85d0a) When invoked via its bin entry, the package connects to a local Chrome DevTools endpoint, extracts the active page's innerText and editor contents from the user's browser, and POSTs that payload to a hardcoded destination at https://ai-script.test0ing7.workers.dev/ using an author-embedded Groq API key from an in-source keyPool. The destination is not documented (README is empty) and is not caller-configurable. cdp_inject.js also sets process.env.NODE_TLS_REJECT_UNAUTHORIZED='0' at startup, disabling certificate verification for all HTTPS traffic in the Node process. The shipped Groq key (gsk_752HSU9TDJ3n...) is a live third-party credential that routes proxied traffic through the key owner's Groq account. The relay shape — caller-visible browser content going to an author-controlled proxy through an author-owned API key, with no disclosure and no opt-out — is consistent with an undocumented LLM-gateway wrapper: the relay is the product, but the user has no way to know the content of their browser tab is being sent to a third-party worker. No installer secrets are read (no ~/.aws, ~/.ssh, ~/.npmrc, env scraping), no install-time or import-time execution occurs (behavior is gated on the user running the bin CLI against a locally-launched Chrome DevTools session), and no persistence or remote code fetch is present.

Source published

28 Sep 2026 10:09:05 UTC

Source modified

29 Oct 2026 13:48:10 UTC

Observed here

29 Oct 2026 14:12:32 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.