godzzz

GHSA-6j9r-v67w-r8w4

Malicious code in godzzz (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (39f05673527822a16dc88d65a9ff9471548f8046fc28c7930fd8958dbcc38f3a)
The npm package [email protected] ships cdp_inject.js which imports http, https, child_process and fs at the top of the file, reads process.env (including process.env.USER), reads files from disk via fs.readFileSync/fs.existsSync, base64-encodes payloads via toString('base64'), and issues outbound network calls via https.request, http.get and POST. The combination of installer-side environment and filesystem reads, base64 encoding of the resulting data, and outbound HTTP/HTTPS in a single small script matches the shape of a host-info / credential exfiltration stager rather than a legitimate library.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/d9a451cbb73776aade5f2f5ad3ae60f5eb2524ec/osv/malicious/npm/godzzz/MAL-2026-16463.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/d9a451cbb73776aade5f2f5ad3ae60f5eb2524ec/osv/malicious/npm/godzzz/MAL-2026-16463.json
- https://www.npmjs.com/package/godzzz/v/1.0.0
- https://github.com/advisories/GHSA-6j9r-v67w-r8w4

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.