Which versions of golaaa are malicious?

The following npm versions of golaaa are flagged malicious: 1.0.0, 1.0.3, 2.0.3. Treat any of these as compromised.

How do I remediate golaaa if I installed it?

golaaa is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed golaaa — how do I know if it already compromised me?

If golaaa was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is golaaa part of a known attack campaign?

Yes — golaaa is associated with the IN-MAL-2026-015990, IN-MAL-2026-018417, IN-MAL-2026-020453 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find golaaa across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for golaaa (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging golaaa across your stack and pipelines.

Malicious package

golaaanpm

golaaa is a confirmed malicious npm package (MAL-2026-13392) that steals credentials and exfiltrates sensitive data (malicious versions 1.0.0, 1.0.3, 2.0.3). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in golaaa (npm)

MAL-2026-13392

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall golaaa

What this malware does

The package's main module (cdp_inject.js) runs on require. It disables TLS certificate verification process-wide (process.env.NODE_TLS_REJECT_UNAUTHORIZED='0'), taskkills and re-launches a local browser executable at %USERPROFILE%\AppData\Local\Programs\testpad\testpad.exe with --remote-debugging-port=9222, and connects to it via the Chrome DevTools Protocol on 127.0.0.1:9222. It then injects a script into every attached page that captures document.body.innerText and the active editor's contents on user gestures, base64-encodes the payload, and POSTs it to the hardcoded endpoint https://ai-script.test0ing7.workers.dev/ (a Cloudflare Workers proxy that forwards to Groq). The response body from that remote endpoint is interpolated into a CDP Runtime.evaluate expression (window._rR(<remote JSON>)) and executed in the context of the user's browser pages, giving the remote endpoint arbitrary JavaScript execution in the victim's browser sessions (including CSP-restricted pages) with keystrokes auto-typed back into the page. A Groq API key is also embedded in the source, obfuscated with an XOR-over-base64 routine (_xd with key 'Mx7rLp2Qn') and POSTed as the 'key' field to the same proxy. The exfiltration destination is hardcoded and not caller-configurable, and the module load starts the polling loop with no opt-in.

Malicious versions

3 flagged

1.0.01.0.32.0.3

Indicators of compromise (SHA-256)

01b6c227c2b9147d78df3a778d5de60d58b9cb115c6e7a7ce811143e05413ceb

43f9a2a9514f30f4def10f6a0a21b4abf4f882fa29a45c6b7c93e96490f49c13

331000f972f1801aba45a29c2532427a216d06ec60ca26e14d3e293aac517267

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for golaaa (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging golaaa across your stack and pipelines.
If you installed it — respond
golaaa is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If golaaa was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks golaaa before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. golaaa on npm has been identified as a malicious package (versions 1.0.0, 1.0.3, 2.0.3 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-015990IN-MAL-2026-018417IN-MAL-2026-020453

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks golaaa-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database