godsplan

GHSA-pgx2-9j7q-49rp

Malicious code in godsplan (npm)

Details

**Severity:** Critical

**Affected versions:** `= 3.0.2`

Running the godsplan 3.0.2 CLI connects to Chrome's debugging port (9222) and injects JavaScript into every open page. It bypasses Content Security Policy and intercepts selected test-page requests. When triggered by a mouse gesture or keyboard shortcut, the injected script collects the page text and current editor input; the CLI sends that content to https://ai-script.test0ing7.workers.dev/ for AI-generated answers and inserts the response into the page. The package also disables TLS certificate verification with NODE_TLS_REJECT_UNAUTHORIZED=0. This behavior can disclose browser-page and editor contents to an external service and alter test-page content. The observed trigger is CLI execution; no install-time execution was identified.

Evidence: package/cdp_inject.js:2 disables TLS verification; lines 150-180 collect page and editor content; lines 252-282 send the content to the external endpoint; lines 330-350 connect to Chrome, bypass CSP and inject the script; lines 370-390 forward the collected content. Static review of the published npm tarball (sha256 8627139afbb193624535de0c32348e7b2747449ed9940f9c29e4dfb5a3f9a350); the package was not executed during manual review.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/9c35d3c259cf5aa9a7fddbc1b6fc46fcb3fc0a24/osv/malicious/npm/godsplan/MAL-2026-17315.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/9c35d3c259cf5aa9a7fddbc1b6fc46fcb3fc0a24/osv/malicious/npm/godsplan/MAL-2026-17315.json
- https://github.com/ossf/malicious-packages/blob/8afbc0946efbfcdd4c652f6dc2a42db36f641a46/osv/malicious/npm/godsplan/MAL-2026-17315.json
- https://www.npmjs.com/package/godsplan/v/3.0.2
- https://github.com/advisories/GHSA-pgx2-9j7q-49rp

Compromised versions (1)

= 3.0.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.