{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "cdp_inject.js",
              "sha256": "36cda76bbf7396ceb3cc6317680c60edaf9809787805a678f7fe9a97c7635ba0",
              "tlsh": "b792c58a64a6213585b6b3b98f539515f73ad033710143b4fd5c86982ff287482b6fcd"
            }
          ],
          "package_integrity": [
            {
              "filename": "godzz-1.0.0.tgz",
              "hashes": {
                "sha1": "8a40fd049eb9824ed0ca9d94d0627ba55c3fa77d",
                "sha512_sri": "sha512-CznG49Dd0N43cfVsBYJkM7cjur9e7wQnXXZBxwoT1ZhYf4agbWZbUduDzKXssr25m7WU6LENZ7Vkm+dARcg3Wg=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "godzz"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-020455",
        "import_time": "2026-09-23T05:18:35.018942945Z",
        "modified_time": "2026-09-23T04:48:48Z",
        "sha256": "3b5d71d42ffa8a11d58cf5bf2cf8eab5f95e14d047f0907b6e0581a3c33ea299",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3b5d71d42ffa8a11d58cf5bf2cf8eab5f95e14d047f0907b6e0581a3c33ea299)\nOn module load, godzz sets process.env.NODE_TLS_REJECT_UNAUTHORIZED=\u00270\u0027, disabling TLS certificate validation for the entire Node process. Its main entry attaches to a local Chromium CDP endpoint at 127.0.0.1:9222, injects a script that scrapes document.body.innerText and the active editor\u0027s contents, base64-encodes the payload, and POSTs it via https.request to a hardcoded, non-configurable endpoint at ai-script.test0ing7.workers.dev along with a bundled Groq API key from an in-source keyPool. The destination is an author-operated Cloudflare Worker, not a first-party Groq endpoint and not caller-configurable, so caller-supplied page and code content is silently relayed through the author\u0027s infrastructure. The shipped Groq API key (gsk_...) is also redistributed to every installer.\n",
  "id": "MAL-2026-16462",
  "modified": "2026-09-23T04:48:48Z",
  "published": "2026-09-23T04:48:48Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/godzz/v/1.0.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in godzz (npm)"
}