MAL-2026-13392

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/golaaa/MAL-2026-13392.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13392
Published
2026-08-06T12:13:09Z
Modified
2026-08-19T09:30:16Z
Summary
Malicious code in golaaa (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (43f9a2a9514f30f4def10f6a0a21b4abf4f882fa29a45c6b7c93e96490f49c13)

The package's main module (cdp_inject.js) runs on require. It disables TLS certificate verification process-wide (process.env.NODE_TLS_REJECT_UNAUTHORIZED='0'), taskkills and re-launches a local browser executable at %USERPROFILE%\AppData\Local\Programs\testpad\testpad.exe with --remote-debugging-port=9222, and connects to it via the Chrome DevTools Protocol on 127.0.0.1:9222. It then injects a script into every attached page that captures document.body.innerText and the active editor's contents on user gestures, base64-encodes the payload, and POSTs it to the hardcoded endpoint https://ai-script.test0ing7.workers.dev/ (a Cloudflare Workers proxy that forwards to Groq). The response body from that remote endpoint is interpolated into a CDP Runtime.evaluate expression (window._rR()) and executed in the context of the user's browser pages, giving the remote endpoint arbitrary JavaScript execution in the victim's browser sessions (including CSP-restricted pages) with keystrokes auto-typed back into the page. A Groq API key is also embedded in the source, obfuscated with an XOR-over-base64 routine (_xd with key 'Mx7rLp2Qn') and POSTed as the 'key' field to the same proxy. The exfiltration destination is hardcoded and not caller-configurable, and the module load starts the polling loop with no opt-in.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015990",
            "import_time": "2026-08-06T12:16:02.7383252Z",
            "modified_time": "2026-08-06T12:13:09Z",
            "sha256": "01b6c227c2b9147d78df3a778d5de60d58b9cb115c6e7a7ce811143e05413ceb",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-018417",
            "import_time": "2026-08-19T09:15:25.321049972Z",
            "modified_time": "2026-08-19T09:14:32Z",
            "sha256": "43f9a2a9514f30f4def10f6a0a21b4abf4f882fa29a45c6b7c93e96490f49c13",
            "source": "amazon-inspector",
            "versions": [
                "1.0.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / golaaa

Package

Name
golaaa
View open source insights on deps.dev
Purl
pkg:npm/golaaa

Affected ranges

Affected versions

1.*
1.0.0
1.0.3

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "cdp_inject.js",
            "sha256": "cea9a71f32d76323858615e08889cc52496702623b19ee4cdce1612ad978fc58",
            "tlsh": "7c82e69760a6213585b6f3b99f538546f73ae023310103b4be5c86982ff28b48276fdd"
        }
    ],
    "package_integrity": [
        {
            "filename": "golaaa-1.0.0.tgz",
            "hashes": {
                "sha1": "75ad102f6d2387d693d1adf54a61031ff39f0694",
                "sha512_sri": "sha512-stOg5PT7VzAi4XmwRUIEFfcdn/9tE/UAgvP+IwB5z2wxmjAqSj7ZeYixCVHZxLtQXc83R1pAWTn1GCjK3Tm/Fw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/golaaa/MAL-2026-13392.json"