The golaaa npm package contains malicious code that disables TLS certificate verification, forcibly restarts a local browser executable with remote debugging enabled, and injects scripts into browser pages to exfiltrate user data. It captures page content and editor inputs, encodes them, and sends them to a hardcoded remote endpoint. The remote endpoint can execute arbitrary JavaScript in the victim's browser context, bypassing Content Security Policy restrictions and simulating keystrokes. An embedded, obfuscated Groq API key is also sent to the attacker-controlled server. This behavior occurs automatically upon module load without user consent.