{"id":"MAL-2026-13392","summary":"Malicious code in golaaa (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (43f9a2a9514f30f4def10f6a0a21b4abf4f882fa29a45c6b7c93e96490f49c13)\nThe package's main module (cdp_inject.js) runs on require. It disables TLS certificate verification process-wide (process.env.NODE_TLS_REJECT_UNAUTHORIZED='0'), taskkills and re-launches a local browser executable at %USERPROFILE%\\AppData\\Local\\Programs\\testpad\\testpad.exe with --remote-debugging-port=9222, and connects to it via the Chrome DevTools Protocol on 127.0.0.1:9222. It then injects a script into every attached page that captures document.body.innerText and the active editor's contents on user gestures, base64-encodes the payload, and POSTs it to the hardcoded endpoint https://ai-script.test0ing7.workers.dev/ (a Cloudflare Workers proxy that forwards to Groq). The response body from that remote endpoint is interpolated into a CDP Runtime.evaluate expression (window._rR(\u003cremote JSON\u003e)) and executed in the context of the user's browser pages, giving the remote endpoint arbitrary JavaScript execution in the victim's browser sessions (including CSP-restricted pages) with keystrokes auto-typed back into the page. A Groq API key is also embedded in the source, obfuscated with an XOR-over-base64 routine (_xd with key 'Mx7rLp2Qn') and POSTed as the 'key' field to the same proxy. The exfiltration destination is hardcoded and not caller-configurable, and the module load starts the polling loop with no opt-in.\n","modified":"2026-09-23T05:30:08.728321543Z","published":"2026-08-06T12:13:09Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-015990","import_time":"2026-08-06T12:16:02.7383252Z","modified_time":"2026-08-06T12:13:09Z","sha256":"01b6c227c2b9147d78df3a778d5de60d58b9cb115c6e7a7ce811143e05413ceb"},{"sha256":"43f9a2a9514f30f4def10f6a0a21b4abf4f882fa29a45c6b7c93e96490f49c13","source":"amazon-inspector","versions":["1.0.3"],"id":"IN-MAL-2026-018417","import_time":"2026-08-19T09:15:25.321049972Z","modified_time":"2026-08-19T09:14:32Z"},{"import_time":"2026-09-23T05:18:34.799140311Z","modified_time":"2026-09-23T04:48:29Z","sha256":"331000f972f1801aba45a29c2532427a216d06ec60ca26e14d3e293aac517267","source":"amazon-inspector","versions":["2.0.3"],"id":"IN-MAL-2026-020453"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/golaaa/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/golaaa/v/1.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/golaaa/v/2.0.3"}],"affected":[{"package":{"name":"golaaa","ecosystem":"npm","purl":"pkg:npm/golaaa"},"versions":["1.0.0","1.0.3","2.0.3"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/golaaa/MAL-2026-13392.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"tlsh":"7c82e69760a6213585b6f3b99f538546f73ae023310103b4be5c86982ff28b48276fdd","path":"cdp_inject.js","sha256":"cea9a71f32d76323858615e08889cc52496702623b19ee4cdce1612ad978fc58"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-stOg5PT7VzAi4XmwRUIEFfcdn/9tE/UAgvP+IwB5z2wxmjAqSj7ZeYixCVHZxLtQXc83R1pAWTn1GCjK3Tm/Fw==","sha1":"75ad102f6d2387d693d1adf54a61031ff39f0694"},"filename":"golaaa-1.0.0.tgz"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}