The golaaa npm package (version 1.0.0) contains a malicious main module (cdp_inject.js) that disables TLS certificate verification globally by setting process.env.NODE_TLS_REJECT_UNAUTHORIZED='0'. It forcibly terminates and restarts a local browser executable located at %USERPROFILE%\AppData\Local\Programs\testpad\testpad.exe with remote debugging enabled on port 9222. The package connects to this browser via the Chrome DevTools Protocol and injects a script into every attached page. This script captures the document body text and active editor contents on user gestures, base64-encodes this data, and sends it via POST to a hardcoded Cloudflare Workers proxy endpoint (https://ai-script.test0ing7.workers.dev/), which forwards to Groq. The remote response is executed as JavaScript in the browser context, allowing arbitrary code execution including on pages with Content Security Policy restrictions. The package also embeds an obfuscated Groq API key, which it sends to the same proxy. This malicious behavior starts immediately upon requiring the module, without any opt-in or configuration.

This malicious package compromises the confidentiality and integrity of user data by exfiltrating sensitive page content and editor inputs to a remote attacker-controlled server. It disables TLS verification, increasing the risk of man-in-the-middle attacks. The injected code enables arbitrary JavaScript execution in the victim's browser sessions, including on CSP-restricted pages, potentially allowing full browser session compromise and keystroke injection. This can lead to credential theft, session hijacking, and further compromise of the victim's environment.

No official patch or remediation is currently documented. Users should immediately remove the golaaa package version 1.0.0 from their environments and avoid installing or requiring this package. Since the malicious behavior activates on module load without opt-in, uninstalling and replacing the package with a trusted alternative is critical. Monitor for any unauthorized browser processes (such as testpad.exe) running with remote debugging enabled and terminate them. Check for any suspicious network connections to the hardcoded exfiltration endpoint and block them at the network perimeter. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.