GCVE-110-OSM-2026-11716

The npm package `orbitron-tui` is malicious. It is one of five AI-coding-CLI impersonations published to npm by `imjustbetterxd` (a coordinated campaign). On use, the CLI reads the developer's LLM/provider API key - from environment variables (e.g. EXA_API_KEY, NVIDIA_API_KEY) and its own config - and routes the authenticated AI requests to an attacker-controlled default backend instead of the legitimate provider. Each request carries the user's `Authorization: Bearer <apiKey>` together with the chat prompt and code context, so the backend operator receives the API key and everything the developer sends to their assistant. Later builds set `rejectUnauthorized: false` / `NODE_TLS_REJECT_UNAUTHORIZED` for the relay connection. Payloads/updates are hosted on the GitHub account `Marcus-Mok-GH`. All 84 published versions (0.1.2 through 1.0.29) are affected - the relay is present from the very first version (0.1.2), so the entire package is malicious. The relay backend rotated from `orbitron--pastelsjuice8t.replit.app` (0.1.x-0.4.x) to `fireworks-endpoint--57crestcrepe.replit.app` (1.0.x, the same host used by codebuff-cli and agent-free). The `bin` entry launches a bundled binary that performs the relay. Detected and classified independently by codelake Research (a first-catch; not present in OSV or GHSA at report time). Judge assessment: This package matches a coordinated AI-CLI impersonation campaign by `imjustbetterxd` and the code shows an attacker-controlled relay backend, so the plausible attacker model is credential and prompt theft from developers using an LLM assistant. The entrypoint and wrapper chain (`bin/orbitron.mjs` -> `dist/orbitron`) is paired with `dist/update.js` setting `NODE_TLS_REJECT_UNAUTHORIZED = "0"` and fetching from `https://fireworks-endpoint--57crestcrepe.replit.app/v1/models`, which is consistent with silently routing authenticated requests to a hostile server. The presence of `env-exfiltration`, `download-execute-delete`, and multiple reconstructed exfil URLs, plus the README pinning `ORBITRON_BACKEND_URL` to that same Replit host, indicates deliberate exfiltration rather than a benign backend config. The obfuscated `dist/lib/ca-bundle.pem` and the OSV advisory describing theft of provider API keys further corroborate that this is a malicious relay, not a normal TUI backend. ENTRY bin/orbitron.mjs (bin: bin/orbitron.mjs) DESTINATION - 4 exfil (reconstructed) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in dist/update.js: "process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0"; const res = await fetch" - Data Encoding for Exfiltration in dist/commands.js: "Buffer.from(content).toString("base64")" - Data Encoding for Exfiltration in dist/screens/chat-screen.js: "Buffer.from(content).toString("base64")" - Network Request in dist/update.js: "fetch("https:" OBFUSCATION - Decoded Base64 Content in dist/lib/ca-bundle.pem (x190) - Decoded Base64 Content in src/lib/ca-bundle.pem (x190) - Unicode Escape Obfuscation in dist/screens/chat-screen.js: "\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u..." - Obfuscation patterns: unicodeHeavy in dist/screens/chat-screen.js - recovered 15 domains, 17 urls from decoded/deobfuscated content ADDITIONAL FINDINGS - Download Execute Delete Pattern in bin/orbitron-wrapper.mjs: "spawnSync } from 'node:child_process'; import { statSync } from 'node:fs'; impor..." - Reconstructed Obfuscated URL in bin/orbitron-wrapper.mjs: "https://fireworks-endpoint--57crestcrepe.replit.app" - Shell Command Execution in bin/ob: "require("child_process")" - Clipboard Access in dist/screens/chat-screen.js: "navigator.clipboard.readText" PAYLOAD FILES dist/lib/ca-bundle.pem (+ src/lib/ca-bundle.pem)