Malicious code in godsplan (npm)

Running the godsplan 3.0.2 CLI connects to Chrome's debugging port (9222) and injects JavaScript into every open page. It bypasses Content Security Policy and intercepts selected test-page requests. When triggered by a mouse gesture or keyboard shortcut, the injected script collects the page text and current editor input; the CLI sends that content to https://ai-script.test0ing7.workers.dev/ for AI-generated answers and inserts the response into the page. The package also disables TLS certificate verification with NODE_TLS_REJECT_UNAUTHORIZED=0. This behavior can disclose browser-page and editor contents to an external service and alter test-page content. The observed trigger is CLI execution; no install-time execution was identified. Evidence: package/cdp_inject.js:2 disables TLS verification; lines 150-180 collect page and editor content; lines 252-282 send the content to the external endpoint; lines 330-350 connect to Chrome, bypass CSP and inject the script; lines 370-390 forward the collected content. Static review of the published npm tarball (sha256 8627139afbb193624535de0c32348e7b2747449ed9940f9c29e4dfb5a3f9a350); the package was not executed during manual review. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (05dc2e058b489230e57e20471e55ae2f1e2d453f25a759ea5742f340eec85d0a) When invoked via its bin entry, the package connects to a local Chrome DevTools endpoint, extracts the active page's innerText and editor contents from the user's browser, and POSTs that payload to a hardcoded destination at https://ai-script.test0ing7.workers.dev/ using an author-embedded Groq API key from an in-source keyPool. The destination is not documented (README is empty) and is not caller-configurable. cdp_inject.js also sets process.env.NODE_TLS_REJECT_UNAUTHORIZED='0' at startup, disabling certificate verification for all HTTPS traffic in the Node process. The shipped Groq key (gsk_752HSU9TDJ3n...) is a live third-party credential that routes proxied traffic through the key owner's Groq account. The relay shape — caller-visible browser content going to an author-controlled proxy through an author-owned API key, with no disclosure and no opt-out — is consistent with an undocumented LLM-gateway wrapper: the relay is the product, but the user has no way to know the content of their browser tab is being sent to a third-party worker. No installer secrets are read (no ~/.aws, ~/.ssh, ~/.npmrc, env scraping), no install-time or import-time execution occurs (behavior is gated on the user running the bin CLI against a locally-launched Chrome DevTools session), and no persistence or remote code fetch is present.

Source published

28 Sep 2026 10:09:05 UTC

Source modified

29 Oct 2026 13:48:10 UTC

Observed here

29 Oct 2026 14:12:32 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.