Which versions of godsplan are malicious?

The following npm versions of godsplan are flagged malicious: 3.0.2. Treat any of these as compromised.

How do I remediate godsplan if I installed it?

godsplan is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed godsplan — how do I know if it already compromised me?

If godsplan was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is godsplan part of a known attack campaign?

Yes — godsplan is associated with the IN-MAL-2026-021967 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find godsplan across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for godsplan (version 3.0.2).

Malicious package

godsplannpm

Advisory published Sep 28, 2026Updated Oct 29, 2026

godsplan is a confirmed malicious npm package (MAL-2026-17315) that steals credentials and exfiltrates sensitive data (malicious version 3.0.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in godsplan (npm)

MAL-2026-17315

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall godsplan

What this malware does

Running the godsplan 3.0.2 CLI connects to Chrome's debugging port (9222) and injects JavaScript into every open page. It bypasses Content Security Policy and intercepts selected test-page requests. When triggered by a mouse gesture or keyboard shortcut, the injected script collects the page text and current editor input; the CLI sends that content to https://ai-script.test0ing7.workers.dev/ for AI-generated answers and inserts the response into the page. The package also disables TLS certificate verification with NODE_TLS_REJECT_UNAUTHORIZED=0. This behavior can disclose browser-page and editor contents to an external service and alter test-page content. The observed trigger is CLI execution; no install-time execution was identified.

Evidence: package/cdp_inject.js:2 disables TLS verification; lines 150-180 collect page and editor content; lines 252-282 send the content to the external endpoint; lines 330-350 connect to Chrome, bypass CSP and inject the script; lines 370-390 forward the collected content. Static review of the published npm tarball (sha256 8627139afbb193624535de0c32348e7b2747449ed9940f9c29e4dfb5a3f9a350); the package was not executed during manual review.

When invoked via its bin entry, the package connects to a local Chrome DevTools endpoint, extracts the active page's innerText and editor contents from the user's browser, and POSTs that payload to a hardcoded destination at https://ai-script.test0ing7.workers.dev/ using an author-embedded Groq API key from an in-source keyPool. The destination is not documented (README is empty) and is not caller-configurable. cdp_inject.js also sets process.env.NODE_TLS_REJECT_UNAUTHORIZED='0' at startup, disabling certificate verification for all HTTPS traffic in the Node process. The shipped Groq key (gsk_752HSU9TDJ3n...) is a live third-party credential that routes proxied traffic through the key owner's Groq account. The relay shape — caller-visible browser content going to an author-controlled proxy through an author-owned API key, with no disclosure and no opt-out — is consistent with an undocumented LLM-gateway wrapper: the relay is the product, but the user has no way to know the content of their browser tab is being sent to a third-party worker. No installer secrets are read (no ~/.aws, ~/.ssh, ~/.npmrc, env scraping), no install-time or import-time execution occurs (behavior is gated on the user running the bin CLI against a locally-launched Chrome DevTools session), and no persistence or remote code fetch is present.

Malicious versions

1 flagged

3.0.2

Indicators of compromise (SHA-256)

05dc2e058b489230e57e20471e55ae2f1e2d453f25a759ea5742f340eec85d0a

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for godsplan (version 3.0.2).
If you installed it — respond
godsplan is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If godsplan was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. godsplan on npm has been identified as a malicious package (version 3.0.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-021967

References

npmjs.com

Credits

Amazon Inspector · finder
smiling-hyena · finder

Detect & block this

O3 blocks godsplan-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database