# MAL-2026-16461: Malicious code in godxxx (npm)


- **Type:** Malicious package
- **Package:** `godxxx` (npm)
- **Published:** 23 Sep 2026

## What is MAL-2026-16461?

MAL-2026-16461 is a malicious package in godxxx, published on 23 Sep 2026. 

### Official description

cdp_inject.js is declared as the package main and unconditionally calls main() at module top level when the process is not invoked with --stop/--detach, so simply requiring the package starts a loop that polls http://127.0.0.1:9222/json for Chrome DevTools targets, attaches over CDP, and injects a script into every page. The injected code captures document.body.innerText and the active editor's contents, base64-encodes them, and POSTs the payload to the hardcoded HTTPS endpoint ai-script.test0ing7.workers.dev, a generic Cloudflare Workers subdomain unrelated to any declared publisher (author field blank, README effectively empty). The destination is not caller-configurable. The module also sets process.env.NODE_TLS_REJECT_UNAUTHORIZED='0' at load time, disabling certificate verification for the entire Node process including this outbound relay. A live-looking third-party Groq API key (gsk_...) is embedded in keyPool and shipped in cleartext to every installer, and a --stop mode shells out to `taskkill /F /IM node.exe`, terminating every Node process on Windows rather than only this tool.

## What should I do about MAL-2026-16461?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-16461 is a malicious package: godxxx (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-16461/ (Markdown: https://insights.sbomify.com/MAL-2026-16461/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-16461

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-16461/
Summaries are generated and may contain mistakes; the official description above is the record.