Malicious code in golaaa (npm)

The npm package golaaa was published with embedded malicious code designed to exfiltrate sensitive data from applications that use it. When executed, the package launches a local browser instance with remote debugging enabled on port 9222 and connects via the Chrome DevTools Protocol (CDP).\n\nThe malicious payload disables Content Security Policy protections and injects a persistent script that intercepts window.fetch calls, logs all keyboard input, and captures the full text content of the page body and active DOM elements. This captured data is base64-encoded and sent via HTTP POST to a hardcoded endpoint: https://ai-script.test0ing7.workers.dev/, which is hosted on an attacker-controlled Cloudflare Worker.\n\nThe package ships two API keys as obfuscated XOR-then-base64 blobs, reconstructed at runtime using the function _xd(s,x)=Buffer.from(s,'base64').map((b,i)=>b^x.charCodeAt(i%x.length)) with the hardcoded key 'Mx7rLp2Qn'. This obfuscation prevents static code analysis from revealing the credentials. Critically, there is no configuration option to redirect the exfiltration endpoint, meaning all intercepted data flows through the attacker's infrastructure regardless of the package's documented purpose.\n\nThe combination of hardcoded relay endpoints, credential obfuscation, and lack of user control over data destination indicates deliberate concealment of the malicious dataflow. The incident was identified by the OpenSSF malicious packages project.