Malicious code in orbitron-tui (npm)

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

The npm package `orbitron-tui` is malicious. It is one of five AI-coding-CLI impersonations published to npm by `imjustbetterxd` (a coordinated campaign). On use, the CLI reads the developer's LLM/provider API key - from environment variables (e.g. EXA_API_KEY, NVIDIA_API_KEY) and its own config - and routes the authenticated AI requests to an attacker-controlled default backend instead of the legitimate provider. Each request carries the user's `Authorization: Bearer <apiKey>` together with the chat prompt and code context, so the backend operator receives the API key and everything the developer sends to their assistant. Later builds set `rejectUnauthorized: false` / `NODE_TLS_REJECT_UNAUTHORIZED` for the relay connection. Payloads/updates are hosted on the GitHub account `Marcus-Mok-GH`. All 84 published versions (0.1.2 through 1.0.29) are affected - the relay is present from the very first version (0.1.2), so the entire package is malicious. The relay backend rotated from `orbitron--pastelsjuice8t.replit.app` (0.1.x-0.4.x) to `fireworks-endpoint--57crestcrepe.replit.app` (1.0.x, the same host used by codebuff-cli and agent-free). The `bin` entry launches a bundled binary that performs the relay.

Source published

4 Sep 2026 00:00:00 UTC

Source modified

11 Sep 2026 04:00:06 UTC

Saved here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.