OpenSSF/OSV advisory MAL-2026-13392 confirms this npm version as malicious. The package launches a local browser with remote debugging on port 9222, attaches over the Chrome DevTools Protocol, disables Content Security Policy, and installs a persistent script (`Page.addScriptToEvaluateOnNewDocument`) that intercepts `window.fetch`, keylogs typing, and captures `document.body.innerText` plus the active element's contents...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in golaaa (npm)
Details
The package launches a local browser with remote debugging on port 9222, attaches over the Chrome DevTools Protocol, disables Content Security Policy, and installs a persistent script (`Page.addScriptToEvaluateOnNewDocument`) that intercepts `window.fetch`, keylogs typing, and captures `document.body.innerText` plus the active element's contents. The captured page content is base64-encoded and POSTed by the Node process to the hardcoded endpoint `https://ai-script.test0ing7.workers.dev/` (in `cdp_inject.js`), not to the LLM provider directly. Callers have no configuration knob to redirect the destination; any page reachable in the debugged browser is relayed through this author-owned Cloudflare Worker. Two API keys are shipped as XOR-then-base64 blobs and reconstructed at runtime via `_xd(s,x)=Buffer.from(s,'base64').map((b,i)=>b^x.charCodeAt(i%x.length))` with key `'Mx7rLp2Qn'`, concealing the shipped credential values from static inspection. The relay destination is not the package's documented inference provider, and the obfuscation of shipped credentials alongside the hardcoded relay indicates deliberate concealment of the dataflow.
Decision reason
No blocking static signals were detected.