registry / godzz / 1.0.0

godzz@1.0.0

OSV Malicious Advisory

imported 17d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16462 confirms this npm version as malicious. On module load, godzz sets process.env.NODE_TLS_REJECT_UNAUTHORIZED='0', disabling TLS certificate validation for the entire Node process. Its main entry attaches to a local Chromium CDP endpoint at 127.0.0.1:9222, injects a script that scrapes document.body.innerText and the active editor's contents, base64-encodes the payload, and POSTs it via https.request to a hardcoded, non-configurable endpoint at...

Advisory

MAL-2026-16462

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in godzz (npm)

Details

On module load, godzz sets process.env.NODE_TLS_REJECT_UNAUTHORIZED='0', disabling TLS certificate validation for the entire Node process. Its main entry attaches to a local Chromium CDP endpoint at 127.0.0.1:9222, injects a script that scrapes document.body.innerText and the active editor's contents, base64-encodes the payload, and POSTs it via https.request to a hardcoded, non-configurable endpoint at ai-script.test0ing7.workers.dev along with a bundled Groq API key from an in-source keyPool. The destination is an author-operated Cloudflare Worker, not a first-party Groq endpoint and not caller-configurable, so caller-supplied page and code content is silently relayed through the author's infrastructure. The shipped Groq API key (gsk_...) is also redistributed to every installer.

Decision reason

No blocking static signals were detected.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 19.2 KB of source, external domains: 127.0.0.1

Source & flagged code

2 flagged

cdp_inject.jsView file

10} L11: const { exec, execSync, spawn } = require('child_process'); L12: const path = require('path');

High

Child Process

Package source references child process execution.

cdp_inject.jsView on unpkg · L10

1#!/usr/bin/env node L2: process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'; L3: const http = require('http'); L4: const https = require('https'); ... L10: } L11: const { exec, execSync, spawn } = require('child_process'); L12: const path = require('path');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cdp_inject.jsView on unpkg · L1

Source & flagged code

2 flagged · loading source

cdp_inject.jsView file

10} L11: const { exec, execSync, spawn } = require('child_process'); L12: const path = require('path');

High

Child Process

Package source references child process execution.

cdp_inject.jsView on unpkg · L10

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cdp_inject.jsView on unpkg · L1

Findings

3 High2 Medium4 Low

HighChild Processcdp_inject.js

HighShell

HighSame File Env Network Executioncdp_inject.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to godzz@1.0.0.

See version security history for other recorded verdicts.

Avoid installing godzz@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-23 05:30:08.535Z (UTC).

Source advisory published: 2026-09-23 04:48:48.000Z (UTC).