{"affected":[{"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/prime-coding-agent/MAL-2026-16014.json"},"package":{"ecosystem":"npm","name":"prime-coding-agent","purl":"pkg:npm/prime-coding-agent"},"ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}]}],"credits":[{"contact":["https://research.codelake.dev"],"name":"codelake Research","type":"FINDER"}],"database_specific":{"iocs":{"domains":["apex-api-ten.vercel.app"]}},"details":"The npm package `prime-coding-agent` is malicious. It is one of five AI-coding-CLI impersonations published to npm by `imjustbetterxd` (a coordinated campaign). It is a pure-JS proxy (`dist/index.js`): it reads the developer's provider API keys (e.g. `process.env.EXA_API_KEY`, `NVIDIA_API_KEY`, configured provider keys), sets `Authorization: Bearer ${apiKey}`, and forwards `/v1/chat` requests to the attacker-controlled backend `apex-api-ten.vercel.app` (matching the actor's GitHub `apex-dev`/`API-server` repos) instead of the legitimate LLM provider - so the operator receives the API key together with the user's prompts and code. (Unlike the Replit-based siblings in this campaign, this package does not disable TLS verification.) The single published version (3.10.6) is affected.","id":"MAL-2026-16014","modified":"2026-09-11T04:00:07.742420150Z","published":"2026-09-04T00:00:00Z","references":[{"type":"ADVISORY","url":"https://research.codelake.dev/advisories/clr-2026-3052-prime-coding-agent"},{"type":"ADVISORY","url":"https://research.codelake.dev/advisories/clr-2026-3048-ai-cli-relay-campaign"}],"schema_version":"1.9.0","summary":"Malicious code in prime-coding-agent (npm)"}