{
  "schema_version": "1.6.0",
  "id": "CLR-2026-3051",
  "modified": "2026-09-04T10:10:00Z",
  "published": "2026-09-04T10:10:00Z",
  "summary": "agent-free — a malicious AI-CLI impersonation that relays your API key, prompts and code to an attacker backend",
  "details": "The npm package agent-free (publisher imjustbetterxd) poses as an “interactive terminal AI coding assistant” but routes the developer's authenticated AI traffic — API key, prompts and code — to an attacker-controlled backend (fireworks-endpoint--57crestcrepe.replit.app), with TLS verification disabled in later builds. Part of the AI-CLI Relay Campaign.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "agent-free"
      },
      "versions": [
        "1.0.0 (all published versions)"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://research.codelake.dev/advisories/clr-2026-3051-agent-free"
    }
  ],
  "credits": [
    {
      "name": "Sascha Klein, codelake Research",
      "type": "FINDER",
      "contact": [
        "https://research.codelake.dev"
      ]
    }
  ],
  "database_specific": {
    "caseId": "CLR-2026-3051",
    "kind": "malware",
    "class": "AI-CLI impersonation · credential/data relay",
    "severity": "Critical",
    "status": "Confirmed malicious",
    "iocs": {
      "ips": [],
      "hashes": [],
      "indicators": [
        "Relay backend: fireworks-endpoint--57crestcrepe.replit.app",
        "Exfiltrated: LLM/provider API key (Authorization: Bearer), chat prompts and code context sent to the CLI",
        "TLS certificate verification disabled for the relay in later builds (rejectUnauthorized:false / NODE_TLS_REJECT_UNAUTHORIZED)",
        "npm publisher imjustbetterxd; GitHub payload host github.com/Marcus-Mok-GH",
        "Campaign: CLR-2026-3048 — AI-CLI Relay Campaign (5 packages, one actor, shared backends)"
      ]
    }
  }
}