MAL-2026-16463

    Dashboard / Malicious Package / MAL-2026-16463

    MAL-2026-16463

    Published: 23 Sept 2026Last Modified: 23 Sept 2026

    Summary: Malicious code in godzzz (npm)

    Details: Source: amazon-inspector (39f05673527822a16dc88d65a9ff9471548f8046fc28c7930fd8958dbcc38f3a) The npm package [email protected] ships cdp_inject.js which imports http, https, child_process and fs at the top of the file, reads process.env (including process.env.USER), reads files from disk via fs.readFileSync/fs.existsSync, base64-encodes payloads via toString('base64'), and issues outbound network calls via https.request, http.get and POST. The combination of installer-side environment and filesystem reads, base64 encoding of the resulting data, and outbound HTTP/HTTPS in a single small script matches the shape of a host-info / credential exfiltration stager rather than a legitimate library.

    References: https://www.npmjs.com/package/godzzz/v/1.0.0

    Affected packages

    Package

    Name: godzzz

    Purl: pkg:npm/godzzz

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0