⛔ Malware Advisory Detected 2026-09-03 · 11:30 UTC
Confirmed malicious. codelake independently detected this at 2026-09-03 · 11:30 UTC — codelake first-catch for versions 1.0.4, 1.0.10 and 1.1.3 — these are not in the Amazon Inspector list. The package itself was previously disclosed by Amazon Inspector (OSV MAL-2026-4533); this advisory extends the confirmed-malicious set with three additional versions codelake identified independently.. Also documented publicly: MAL-2026-4533 (OSV / Amazon Inspector, 2026-06-12). Verdicts from static code + dataflow review of the published npm tarballs (binary + source-map); no execution.
Advisory · CLR-2026-3046

codebuff-cli — a codebuff impersonation that relays your API key, code and prompts to an attacker backend

An npm package that impersonates the official codebuff (README copied verbatim). Its bundled binary defaults the backend to attacker-controlled endpoints, silently relaying authenticated requests — API key, code, context and messages. Later versions pull a mutable payload from a foreign GitHub repo and even disable TLS certificate verification for it.

CriticalConfirmed maliciousImpersonationCredential / data relayTLS-verify disabledcodelake first-catch · 3 versions
What it is

codebuff-cli is a name-squat of the legitimate codebuff npm package (official: CodebuffAI). The README is copy-pasted from the real project — it even tells users to npm install -g codebuff — but the published artifact is an unofficial, manipulated fork.

It is a credential/data relay: authenticated Codebuff traffic (your API key, source code, context and chat messages) is routed to an attacker-operated backend instead of codebuff.com.

Behaviour (verified statically)

1.0.4 / 1.0.10. The bin entry launches an embedded manipulated binary directly (no install hook needed). Its default endpoint is fireworks-endpoint--57crestcrepe.replit.app; both the binary and its source-map contain this Replit relay.

1.1.3. Default backend fireworks-api-backend.vercel.app; downloads the payload from a foreign GitHub repo and disables TLS certificate verification for the launched payload.

1.0.16 / 1.0.25 (suspicious). Thin wrappers that download and execute a remote binary with no hash or signature check — 1.0.16 from codebuff.com, 1.0.25 from a mutable latest release in Marcus-Mok-GH/codebuff-cli. The shipped archive holds no direct exfil proof, but both fit the campaign.

Timeline
2026-06-12
Prior disclosure
Amazon Inspector publishes OSV MAL-2026-4533 for codebuff-cli (26 versions).
2026-09-03
codelake first-catch
codelake confirms 3 additional malicious versions (1.0.4, 1.0.10, 1.1.3) not in the OSV list.
2026-09-03
Published
Advisory CLR-2026-3046; OSV contribution prepared for the additional versions.
Indicators of compromise
🌐Relay backend (1.0.4 / 1.0.10): fireworks-endpoint--57crestcrepe.replit.app
🌐Relay backend (1.1.3): fireworks-api-backend.vercel.app
📦Foreign payload repo (1.0.25): github.com/Marcus-Mok-GH/codebuff-cli (mutable latest)
🔓1.1.3 disables TLS certificate verification for the launched payload
🧬tarball sha256 1.0.4 970fbb955507af8f178a7ddb47d62662ce6f5a58c92773a080a3753685552211
🧬tarball sha256 1.0.10 8f15aeaebbb2857afce7a2117c0d55a8184f9f35500b89c9c4f564556ee33530
🧬tarball sha256 1.1.3 d50cb1099a1b894be2f2055ff9cccca773e7c0e7397bf4a940f287d9603f4e0c
📋Malicious versions (29): 1.0.4, 1.0.10, 1.0.11, 1.0.12, 1.0.14, 1.0.15, 1.0.17, 1.0.18, 1.0.19, 1.0.20, 1.0.21, 1.0.22, 1.0.23, 1.0.24, 1.0.26, 1.0.27, 1.0.28, 1.1.0, 1.1.1, 1.1.2, 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.1.10, 1.1.11, 1.1.12, 1.1.3. Suspicious: 1.0.16, 1.0.25.
Remediation
#ActionPriority
1 Uninstall codebuff-cli everywhere; install the official codebuff package instead. Immediate
2 Treat any Codebuff/LLM API key used with this package as compromised — rotate it. Immediate
3 Hunt egress for *.replit.app / fireworks-api-backend.vercel.app and downloads from Marcus-Mok-GH/codebuff-cli. High

Verified scope: the bundled/downloaded binary relays authenticated Codebuff traffic to attacker backends; 1.1.3 additionally disables TLS verification. Analysis was static on the published npm tarballs; no execution.