Critical Malicious Code Vulnerability in godxxx Package
Summary
MAL-2026-16461: Malicious code in godxxx (npm). Affects godxxx versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The godxxx package is an npm module designed for various functionalities within JavaScript applications. However, it has been found to contain malicious code that poses significant security risks to users. The package is intended to facilitate development but has been compromised, making it a vector for attacks on applications that utilize it.
Vulnerability Detail
The vulnerability originates from the cdp_inject.js file, which is declared as the main module. This file unconditionally calls the main function at the top level, initiating a loop that polls for Chrome DevTools targets. It injects malicious scripts into every page, capturing sensitive information such as document body text and editor contents. This data is then base64-encoded and sent to a hardcoded HTTPS endpoint, compromising user privacy. Additionally, the module disables TLS certificate verification, allowing for potential man-in-the-middle attacks. A third-party API key is also embedded in the code, further exacerbating the security risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall godxxxIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the godxxx package until a patch is released. Additionally, consider implementing security measures such as monitoring network traffic for unusual activity and using tools like Vulert to detect vulnerabilities in your application.
Conclusion
The godxxx package contains a critical vulnerability that allows for the injection of malicious code, compromising user data and application security. Immediate action is required to update or remove the package to mitigate risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for godxxx →
FAQ
The vulnerability involves malicious code that captures sensitive data and sends it to an external server, compromising user security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, consider removing the package from your application and monitoring for any suspicious activity.
Yes, Vulert can monitor your project in real-time for open-source vulnerabilities using just your package-lock.json file.
Using the compromised package can lead to data breaches, unauthorized access to sensitive information, and potential exploitation of your application.
