Malicious Code Injection in godsplan Package: A Security Risk
Summary
MAL-2026-17315: Malicious code in godsplan (npm). Affects godsplan versions 3.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The godsplan package, available on npm, is designed to facilitate interactions with Chrome's debugging port. It allows users to run commands that can manipulate browser pages. However, the version 3.0.2 has been found to contain a serious security vulnerability that enables malicious code injection into open web pages, compromising user data and privacy.
Vulnerability Detail
The vulnerability in godsplan arises from its CLI functionality that connects to Chrome's debugging port (9222) and injects JavaScript into every open page. This action bypasses the Content Security Policy (CSP) and allows the interception of requests from selected test pages. When triggered by user actions, such as mouse gestures or keyboard shortcuts, the injected script collects sensitive information, including page text and editor input, and sends it to an external service (https://ai-script.test0ing7.workers.dev/) for AI-generated responses. Additionally, the package disables TLS certificate verification, which can lead to further exposure of sensitive data. The vulnerability is triggered upon execution of the CLI, with no indications of execution during installation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall godsplanIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the godsplan CLI until a patched version is released. Additionally, consider disabling the Chrome debugging port or using a different tool that does not have this vulnerability.
Conclusion
The godsplan package version 3.0.2 has a critical vulnerability that allows for malicious code injection, compromising user data and privacy. It is essential for users to update to a patched version as soon as it is available and to consider workarounds to mitigate risks in the meantime.
See every vulnerability recorded for godsplan →
FAQ
The main risk is that it allows malicious code to be injected into web pages, which can lead to unauthorized access to sensitive information and manipulation of page content.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By simply uploading your package-lock.json file, you can receive alerts about vulnerabilities. You can also check your application using the Vulert playground at Vulert Scanner without any signup.
If immediate updates are not possible, refrain from using the godsplan CLI and consider disabling the Chrome debugging port as a precautionary measure.
Yes, disabling TLS certificate verification can help mitigate some risks, but it is not a complete solution. The best approach is to avoid using the vulnerable package until it is patched.
More information can be found on the official GitHub repository and vulnerability databases that track open-source vulnerabilities.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
