⛔ Malware Advisory Detected 2026-09-04 · 10:00 UTC
Confirmed malicious. codelake independently detected this at 2026-09-04 · 10:00 UTC — codelake first-catch for orbitron-tui, orbitron-cli, agent-free and prime-coding-agent — none were catalogued in OSV. codebuff-cli (also part of this cluster) was previously disclosed by Amazon Inspector (OSV MAL-2026-4533); codelake independently mapped the whole campaign to a single actor and shared backend infrastructure.. Also documented publicly: MAL-2026-4533 (OSV / Amazon Inspector, 2026-06-12). Static code + dataflow review of the published npm tarballs; no execution.
Advisory · CLR-2026-3048

A cluster of AI-coding-CLI impersonations (npm) that relay your API key, code and prompts to attacker backends

The npm publisher imjustbetterxd ships a family of packages that impersonate popular AI coding CLIs (codebuff and generic “agent” tools) and silently relay authenticated AI traffic — API key, source code, prompts, /v1/chat — to attacker-controlled Replit/Vercel backends, with TLS certificate verification disabled in later builds. Payloads are hosted on the GitHub account Marcus-Mok-GH.

CriticalConfirmed maliciousCampaign · 5 packagesImpersonationTLS-verify disabledcodelake first-catch · 4 packages
What it is

A coordinated campaign by the npm publisher imjustbetterxd (GitHub payload host Marcus-Mok-GH): five packages that pose as popular AI coding assistants and turn the developer's own AI usage into an exfiltration channel.

Each package is a data/credential relay: the user's authenticated AI traffic — LLM API key, source code, context and chat prompts — is routed to an attacker-operated Replit or Vercel backend instead of the legitimate provider, and later builds disable TLS certificate verification for the relayed connection.

The packages

codebuff-cli — impersonates the official codebuff; relay fireworks-endpoint--57crestcrepe.replit.app / fireworks-api-backend.vercel.app. (Already in OSV MAL-2026-4533; codelake added 1.0.4/1.0.10/1.1.3.)

orbitron-tui — “TUI backend”; all 84 versions (0.1.2–1.0.29) malicious. Relay rotated orbitron--pastelsjuice8t.replit.app → fireworks-endpoint--57crestcrepe.replit.app; TLS-verify disabled from ~1.0.6.

orbitron-cli (1.0.1) — “inspired by codebuff.com's CLI”; relay orbitron--pastelsjuice8t.replit.app, TLS-verify disabled, launches a bundled bin/orbitron binary.

agent-free (1.0.0) — “interactive terminal AI coding assistant”; relay fireworks-endpoint--57crestcrepe.replit.app, TLS-verify disabled.

prime-coding-agent (3.10.6) — “Prime CLI”; forwards /v1/chat requests with the user's Authorization: Bearer to apex-api-ten.vercel.app.

(A sixth package, replit-agent, by the same publisher showed no relay markers and is not included.)

Timeline
2026-03 – 2026-05
Campaign published
imjustbetterxd publishes the cluster (prime-coding-agent 2026-03, agent-free 2026-04, orbitron-tui/cli 2026-04/05, codebuff-cli 2026-05).
2026-06-12
Partial prior disclosure
Amazon Inspector catalogues codebuff-cli only (OSV MAL-2026-4533).
2026-09-04
codelake maps the campaign
codelake confirms 4 additional malicious packages (first-catch) and the shared actor + backend infrastructure.
Indicators of compromise
🌐Relay backends: fireworks-endpoint--57crestcrepe.replit.app, orbitron--pastelsjuice8t.replit.app, fireworks-api-backend.vercel.app, apex-api-ten.vercel.app
👤npm publisher imjustbetterxd; GitHub payload host github.com/Marcus-Mok-GH
🔓TLS certificate verification disabled for the relay (later builds of codebuff-cli, orbitron-tui/cli, agent-free)
📤Exfiltrated: LLM API key (Authorization: Bearer), source code, context, chat prompts (/v1/chat)
📦Packages: codebuff-cli, orbitron-tui (all 84), orbitron-cli 1.0.1, agent-free 1.0.0, prime-coding-agent 3.10.6
Remediation
#ActionPriority
1 Uninstall any of codebuff-cli, orbitron-tui, orbitron-cli, agent-free, prime-coding-agent; use the official upstream tools instead. Immediate
2 Treat any LLM/provider API key used with these CLIs as compromised — rotate it. Immediate
3 Hunt egress for *.replit.app / *.vercel.app relay hosts above and downloads from github.com/Marcus-Mok-GH. High

Verified scope: five npm packages by one publisher relay authenticated AI traffic (API key, code, prompts) to attacker Replit/Vercel backends, TLS verification disabled in later builds. Analysis was static on the published npm tarballs; no execution.