Malicious code in @aubea/mars (npm)
The npm package @aubea/mars contained malicious code that, when invoked as a CLI, establishes a WebSocket connection to a hardcoded third-party relay (wss://cho100.cn/mars-relay) and allows remote code execution through a paired Claude Code/Codex Agent-Client-Protocol session. An attacker controlling the relay can drive file edits and tool execution on the installer's machine.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that invokes the @aubea/mars CLI (npx @aubea/mars) gains remote code execution capability for an attacker controlling the cho100.cn relay.
- Ecosystems
- Attack vectors
- Affected entities
- @aubea/marsnpm package with malicious code in CLI entrypoint
The @aubea/mars npm package contained malicious code in its CLI entrypoint that establishes an unauthorized WebSocket connection to a hardcoded third-party relay at wss://cho100.cn/mars-relay. This relay is not part of the publisher's declared @aubea brand infrastructure.
When the package is invoked via CLI (npx @aubea/mars), it forwards messages from the remote relay into a locally spawned Claude Code/Codex Agent-Client-Protocol session. This allows a remote party connected to the relay to drive file edits and execute tools on the installer's machine, including invocation of local binaries such as /usr/local/bin/codex.
The relay host cho100.cn is hardcoded with no configurable override in the documented CLI flags, meaning whoever controls that host controls the remote-agent channel. The malicious behavior is triggered when the operator runs the CLI, not during package installation via lifecycle hooks.
The incident was identified by the OpenSSF malicious-packages project and published as advisory GHSA-c44x-cv3g-87cx on GitHub.
Indicators of compromise
- Packages
- @aubea/mars
- Domains
- cho100.cn
Remediation
- Immediately uninstall @aubea/mars from all systems
- Audit any systems where @aubea/mars CLI was invoked for unauthorized file modifications or tool executions
- Review network logs for connections to cho100.cn or wss://cho100.cn/mars-relay
- If the package was used in CI/CD pipelines, audit build artifacts and deployments for tampering
- Do not reinstall @aubea/mars; use alternative packages for the intended functionality
Sources
- GitHub Advisory GHSA-c44x-cv3g-87cx · GitHub Advisory Database
Cite this entry
"Malicious code in @aubea/mars (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 6, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-aubea-mars-npm-c21o89
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in 3-buildsight-web (npm)
The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.
npmCompromised package - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @syncraft-labs/vue (npm)
The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.
npmCompromised package