registry / godsplan / 3.0.2

godsplan@3.0.2

CDP utility tool

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Running or importing godsplan attaches to every local Chrome DevTools page, injects a hidden solver, and posts full page and editor text plus a bundled API key to a hardcoded workers.dev host with TLS verification disabled. The --stop path kills all node.exe processes.

Static reason

No blocking static signals were detected.

Trigger

Import of the main module, the cdp-saw bin, or npm start, followed by a left-edge mouse move or Ctrl+Shift+G in an attached page.

Impact

Visible page and editor contents leave the machine to an unrelated operator host, and --stop terminates every Node process on the machine.

Mechanism

The process loops on http://127.0.0.1:9222/json, enables Fetch and Runtime, injects SOLVER_SCRIPT, reads _cdp_solve_ console payloads, and POSTs them to ai-script.test0ing7.workers.dev. Answers are written back through Runtime.evaluate. --stop runs taskkill /F /IM node.exe.

Attack narrative

Starting the package opens a loop against a local browser debugging port and injects a script into every page. A hidden edge-of-screen gesture or chord copies the full page text and editor contents, base64-encodes them, and the host posts that data with a bundled API key to ai-script.test0ing7.workers.dev after turning off TLS verification. Returned answers are pushed back into the page. A --stop argument force-kills every node.exe process, and --detach respawns the same file in the background.

AI rationale

The published entrypoint automatically hooks every local DevTools page and sends captured page and editor text, with an embedded key, to a hardcoded third-party worker while certificate checks are off. That is concrete data exfiltration, and the --stop path adds a broad process kill.

Evidence

package.jsoncdp_inject.jsdemo_test.html

Network endpoints2

Running the godsplan 3.0.2 CLI connects to Chrome's debugging port (9222) and injects JavaScript into every open page. It bypasses Content Security Policy and intercepts selected test-page requests. When triggered by a mouse gesture or keyboard shortcut, the injected script collects the page text and current editor input; the CLI sends that content to https://ai-script.test0ing7.workers.dev/ for AI-generated answers and inserts the response into the page. The package also disables TLS certificate verification with NODE_TLS_REJECT_UNAUTHORIZED=0. This behavior can disclose browser-page and editor contents to an external service and alter test-page content. The observed trigger is CLI execution; no install-time execution was identified. Evidence: package/cdp_inject.js:2 disables TLS verification; lines 150-180 collect page and editor content; lines 252-282 send the content to the external endpoint; lines 330-350 connect to Chrome, bypass CSP and inject the script; lines 370-390 forward the collected content. Static review of the published npm tarball (sha256 8627139afbb193624535de0c32348e7b2747449ed9940f9c29e4dfb5a3f9a350); the package was not executed during manual review.

godsplan@3.0.2

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code