⛔ Malware Advisory Detected 2026-09-04 · 10:10 UTC
Confirmed malicious. codelake independently detected this at 2026-09-04 · 10:10 UTC — codelake first-catch — orbitron-cli was not catalogued in OSV or GHSA at report time. codelake independently identified it and mapped it to the imjustbetterxd AI-CLI Relay Campaign (CLR-2026-3048), which shares one actor and a small set of Replit/Vercel relay backends.. Not yet in any public advisory database at detection time — codelake is the source of record. Static code + dataflow review of the published npm tarballs; no execution, no live callback.
Advisory · CLR-2026-3050

orbitron-cli — a malicious AI-CLI impersonation that relays your API key, prompts and code to an attacker backend

The npm package orbitron-cli (publisher imjustbetterxd) poses as a CLI “inspired by codebuff.com's CLI” but routes the developer's authenticated AI traffic — API key, prompts and code — to an attacker-controlled backend (orbitron--pastelsjuice8t.replit.app), with TLS verification disabled in later builds. Part of the AI-CLI Relay Campaign.

CriticalConfirmed maliciousPart of a campaignCredential / data relaycodelake first-catch
What it is & how it works

orbitron-cli is published to npm by imjustbetterxd and presents as a CLI “inspired by codebuff.com's CLI”. It is one of five packages in the AI-CLI Relay Campaign.

How the relay works. On use, the CLI reads the developer's LLM / provider API key — from environment variables (e.g. EXA_API_KEY, NVIDIA_API_KEY, provider config) and its own settings — and routes the authenticated AI requests to an attacker-controlled default backend instead of the legitimate provider. Each request carries the user's Authorization: Bearer <apiKey> together with the chat prompt and code context, so whoever operates the backend receives the API key and everything the developer sends to their “AI”.

Default backend: orbitron--pastelsjuice8t.replit.app. It is a bun launcher: bin/orbitron imports dist/index.js, which uses dist/backend-client.js (holds the API key) and a bundled dist/orbitron binary. Notably, dist/update.js auto-updates from orbitron-tui's npm latest — the cluster is self-linked, so orbitron-cli pulls and runs orbitron-tui's payload.

TLS. Later builds set rejectUnauthorized: false / NODE_TLS_REJECT_UNAUTHORIZED for the relay connection, removing the last check on where the data actually goes.

Affected versions

Only one version is published (1.0.1, 2026-05-02) and it is malicious — the entire package is affected.

Timeline
2026-03 – 2026-05
Published
orbitron-cli published to npm by imjustbetterxd as part of the cluster.
2026-09-04
codelake first-catch
codelake confirms the relay dataflow and maps the package to the campaign (not previously in OSV/GHSA).
Indicators of compromise
🌐Relay backend: orbitron--pastelsjuice8t.replit.app
🔁dist/update.js auto-updates from registry.npmjs.org/orbitron-tui/latest and spawns the bundled dist/orbitron binary
📤Exfiltrated: LLM/provider API key (Authorization: Bearer), chat prompts and code context sent to the CLI
🔓TLS certificate verification disabled for the relay in later builds (rejectUnauthorized:false / NODE_TLS_REJECT_UNAUTHORIZED)
👤npm publisher imjustbetterxd; GitHub payload host github.com/Marcus-Mok-GH
🔗Campaign: CLR-2026-3048 — AI-CLI Relay Campaign (5 packages, one actor, shared backends)
Remediation
#ActionPriority
1 Uninstall orbitron-cli; use the legitimate upstream tool instead. Immediate
2 Treat every LLM/provider API key used with it as compromised — rotate it (and revoke any that were set in the environment while it ran). Immediate
3 Hunt egress for orbitron--pastelsjuice8t.replit.app and downloads from github.com/Marcus-Mok-GH. High

Part of the AI-CLI Relay Campaign (CLR-2026-3048). Verified by static code + dataflow review of the published npm tarballs; no execution.