⛔ Malware Advisory Detected 2026-09-04 · 10:10 UTC
Confirmed malicious. codelake independently detected this at 2026-09-04 · 10:10 UTC — codelake first-catch — orbitron-tui was not catalogued in OSV or GHSA at report time. codelake independently identified it and mapped it to the imjustbetterxd AI-CLI Relay Campaign (CLR-2026-3048), which shares one actor and a small set of Replit/Vercel relay backends.. Not yet in any public advisory database at detection time — codelake is the source of record. Static code + dataflow review of the published npm tarballs; no execution, no live callback.
Advisory · CLR-2026-3049

orbitron-tui — a malicious AI-CLI impersonation that relays your API key, prompts and code to an attacker backend

The npm package orbitron-tui (publisher imjustbetterxd) poses as a “modular TUI backend for Orbitron” but routes the developer's authenticated AI traffic — API key, prompts and code — to an attacker-controlled backend (orbitron--pastelsjuice8t.replit.app / fireworks-endpoint--57crestcrepe.replit.app), with TLS verification disabled in later builds. Part of the AI-CLI Relay Campaign.

CriticalConfirmed maliciousPart of a campaignCredential / data relaycodelake first-catch
What it is & how it works

orbitron-tui is published to npm by imjustbetterxd and presents as a “modular TUI backend for Orbitron”. It is one of five packages in the AI-CLI Relay Campaign.

How the relay works. On use, the CLI reads the developer's LLM / provider API key — from environment variables (e.g. EXA_API_KEY, NVIDIA_API_KEY, provider config) and its own settings — and routes the authenticated AI requests to an attacker-controlled default backend instead of the legitimate provider. Each request carries the user's Authorization: Bearer <apiKey> together with the chat prompt and code context, so whoever operates the backend receives the API key and everything the developer sends to their “AI”.

Default backend: orbitron--pastelsjuice8t.replit.app / fireworks-endpoint--57crestcrepe.replit.app. The bin entry launches a bundled binary that carries the relay; the backend host rotated from orbitron--pastelsjuice8t.replit.app (0.1.x–0.4.x) to fireworks-endpoint--57crestcrepe.replit.app (1.0.x, the same host codebuff-cli and agent-free use).

TLS. Later builds set rejectUnauthorized: false / NODE_TLS_REJECT_UNAUTHORIZED for the relay connection, removing the last check on where the data actually goes.

Affected versions

All 84 published versions are malicious — the relay is present from the very first version (0.1.2), so there is no clean build. Versions: 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.1.8, 0.1.9, 0.1.10, 0.1.11, 0.1.12, 0.1.13, 0.1.14, 0.1.15, 0.1.16, 0.1.17, 0.1.18, 0.1.19, 0.1.20, 0.2.0–0.2.9, 0.3.0–0.3.24, 0.4.0–0.4.4, 1.0.1–1.0.29 (84 published versions in total).

Backend rotation: orbitron--pastelsjuice8t.replit.app for 0.1.2–0.4.4, then fireworks-endpoint--57crestcrepe.replit.app for 1.0.1–1.0.29. TLS-verify is intermittently disabled in the 0.x line and consistently disabled across the 1.0.x line.

Timeline
2026-03 – 2026-05
Published
orbitron-tui published to npm by imjustbetterxd as part of the cluster.
2026-09-04
codelake first-catch
codelake confirms the relay dataflow and maps the package to the campaign (not previously in OSV/GHSA).
Indicators of compromise
🌐Relay backend: orbitron--pastelsjuice8t.replit.app / fireworks-endpoint--57crestcrepe.replit.app
🧬bin/ launches a bundled binary that performs the relay (the host string is embedded in the build)
📤Exfiltrated: LLM/provider API key (Authorization: Bearer), chat prompts and code context sent to the CLI
🔓TLS certificate verification disabled for the relay in later builds (rejectUnauthorized:false / NODE_TLS_REJECT_UNAUTHORIZED)
👤npm publisher imjustbetterxd; GitHub payload host github.com/Marcus-Mok-GH
🔗Campaign: CLR-2026-3048 — AI-CLI Relay Campaign (5 packages, one actor, shared backends)
Remediation
#ActionPriority
1 Uninstall orbitron-tui; use the legitimate upstream tool instead. Immediate
2 Treat every LLM/provider API key used with it as compromised — rotate it (and revoke any that were set in the environment while it ran). Immediate
3 Hunt egress for orbitron--pastelsjuice8t.replit.app / fireworks-endpoint--57crestcrepe.replit.app and downloads from github.com/Marcus-Mok-GH. High

Part of the AI-CLI Relay Campaign (CLR-2026-3048). Verified by static code + dataflow review of the published npm tarballs; no execution.