registry / Data exfiltration / godsplan
godsplan
CDP utility tool
This report shows the evidence for godsplan@3.0.2, the only known version.
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe published entrypoint automatically hooks every local DevTools page and sends captured page and editor text, with an embedded key, to a hardcoded third-party worker while certificate checks are off. That is concrete data exfiltration, and the --stop path adds a broad process kill.
Static reason
No blocking static signals were detected.
Trigger
Import of the main module, the cdp-saw bin, or npm start, followed by a left-edge mouse move or Ctrl+Shift+G in an attached page.
Impact
Visible page and editor contents leave the machine to an unrelated operator host, and --stop terminates every Node process on the machine.
Mechanism
The process loops on http://127.0.0.1:9222/json, enables Fetch and Runtime, injects SOLVER_SCRIPT, reads _cdp_solve_ console payloads, and POSTs them to ai-script.test0ing7.workers.dev. Answers are written back through Runtime.evaluate. --stop runs taskkill /F /IM node.exe.
Attack narrative
Starting the package opens a loop against a local browser debugging port and injects a script into every page. A hidden edge-of-screen gesture or chord copies the full page text and editor contents, base64-encodes them, and the host posts that data with a bundled API key to ai-script.test0ing7.workers.dev after turning off TLS verification. Returned answers are pushed back into the page. A --stop argument force-kills every node.exe process, and --detach respawns the same file in the background.
AI rationale
The published entrypoint automatically hooks every local DevTools page and sends captured page and editor text, with an embedded key, to a hardcoded third-party worker while certificate checks are off. That is concrete data exfiltration, and the --stop path adds a broad process kill.
Evidence
package.jsoncdp_inject.jsdemo_test.html
Network endpoints2
ai-script.test0ing7.workers.dev127.0.0.1:9222/json
Decision evidence
public snapshotAI called this Malicious at 93.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json sets main and the cdp-saw bin to cdp_inject.js, and that file calls main() on normal startup.
- The injected page script base64-encodes the full page text and active editor contents, and the host POSTs that body plus an embedded API key to ai-script.test0ing7.workers.dev.
- On startup the process attaches to every CDP page on local port 9222, bypasses CSP, and injects the solver into the current document and future documents.
- The process disables TLS certificate verification before the outbound request.
- The --stop flag force-kills every node.exe process, and --detach relaunches this same file detached.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Page capture runs only after the process is started and a left-edge mouse move or Ctrl+Shift+G occurs in the injected page.
- Fetch tampering is limited to URLs containing /test/cdp-solver or /test/ghost-solver.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
Source & flagged code
5 flagged · loading sourcecdp_inject.jsView file
10}
L11: const { exec, execSync, spawn } = require('child_process');
L12: const path = require('path');
High
1#!/usr/bin/env node
L2: process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
L3: const http = require('http');
L4: const https = require('https');
...
L10: }
L11: const { exec, execSync, spawn } = require('child_process');
L12: const path = require('path');
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
cdp_inject.jsView on unpkg · L1421} else { main(); }
High
Ai Review Evidence
package.json sets main and the cdp-saw bin to cdp_inject.js, and that file calls main() on normal startup.
cdp_inject.jsView on unpkg · L421168_w('_cdp_solve_: ' + btoa(unescape(encodeURIComponent(JSON.stringify({ question: pc, currentCode: ec })))));
}
};
document.addEventListener('
Findings
6 High2 Medium4 Low
HighChild Processcdp_inject.js
HighShell
HighSame File Env Network Executioncdp_inject.js
HighAi Review Evidencepackage.json
HighAi Review Evidencecdp_inject.js
HighAi Review Evidencecdp_inject.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to godsplan@3.0.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing godsplan@3.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.