MAL-2026-13392 Malicious code in golaaa (npm)

The package's main module (cdp_inject.js) runs on require. It disables TLS certificate verification process-wide (process.env.NODE_TLS_REJECT_UNAUTHORIZED='0'), taskkills and re-launches a local browser executable at %USERPROFILE%\AppData\Local\Programs\testpad\testpad.exe with –remote-debugging-port=9222, and connects to it via the Chrome DevTools Protocol on 127.0.0.1:9222. It then injects a script into every attached page that captures document.body.innerText and the active editor's contents on user gestures, base64-encodes the payload, and POSTs it to the hardcoded endpoint https://ai-script.test0ing7.workers.dev/ (a Cloudflare Workers proxy that forwards to Groq). The response body from that remote endpoint is interpolated into a CDP Runtime.evaluate expression (window._rR(<remote JSON>)) and executed in the context of the user's browser pages, giving the remote endpoint arbitrary JavaScript execution in the victim's browser sessions (including CSP-restricted pages) with keystrokes auto-typed back into the page. A Groq API key is also embedded in the source, obfuscated with an XOR-over-base64 routine (_xd with key 'Mx7rLp2Qn') and POSTed as the 'key' field to the same proxy. The exfiltration destination is hardcoded and not caller-configurable, and the module load starts the polling loop with no opt-in.