Malicious Code Injection in godzz Package: Critical Security Flaw
Summary
MAL-2026-16462: Malicious code in godzz (npm). Affects godzz versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The godzz package is an npm module designed for interacting with local Chromium CDP endpoints. It allows developers to automate browser tasks and manipulate web pages programmatically. However, this package has been found to contain a serious vulnerability that compromises user data and security.
Vulnerability Detail
The vulnerability originates from the godzz package setting 'process.env.NODE_TLS_REJECT_UNAUTHORIZED' to '0', which disables TLS certificate validation for the entire Node process. This allows malicious actors to intercept and manipulate data. Upon loading the module, it injects a script that scrapes sensitive information from the web page, encodes it, and sends it to a hardcoded endpoint. This behavior not only exposes user data but also redistributes a Groq API key, further compromising security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall godzzIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the godzz package until a secure version is released. Additionally, you can manually set 'process.env.NODE_TLS_REJECT_UNAUTHORIZED' to '1' in your application to enforce TLS certificate validation.
Conclusion
The godzz package contains a critical vulnerability that exposes user data and security. It is essential to update to a patched version or implement workarounds to mitigate risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for godzz →
FAQ
The vulnerability allows malicious code to be executed, potentially leading to data theft and unauthorized access to sensitive information.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Check the npm repository for the latest version of the godzz package. If a patched version is available, update your package using 'npm update godzz'.
As a temporary measure, avoid using the godzz package and ensure that 'process.env.NODE_TLS_REJECT_UNAUTHORIZED' is set to '1' to enforce TLS validation.
For more details, you can reach out to Amazon Inspector at inspector-research@amazon.com.
