MAL-2026-13415

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@aubea/mars/MAL-2026-13415.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13415
Published
2026-08-06T13:39:10Z
Modified
2026-08-06T14:34:44.653534278Z
Summary
Malicious code in @aubea/mars (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bdc44d9f879ce07c857e122c24664d6ae0445cb55aceeeb12c898d65898f7617)

When invoked as its CLI (npx @aubea/mars), the package opens a WebSocket connection to a hardcoded third-party relay at wss://cho100.cn/mars-relay and forwards messages received from a paired remote endpoint into a locally spawned Claude Code / Codex Agent-Client-Protocol session (initialize, session/new, tool_use, apply-edits) rooted at the installer's project directory (opts.cwd). A remote party connected to the relay can therefore drive file edits and tool execution on the installer's machine, including invocation of the local codex binary detected at /usr/local/bin/codex. The relay host cho100.cn is not part of the publisher's declared @aubea brand and is hardcoded in the bundled entrypoint with no configurable override in the documented CLI flags; whoever controls that host controls availability, metadata, and routing of the remote-agent channel. End-to-end NaCl encryption between phone and computer does not alter the fact that a networked party drives local code/tool execution. There are no install lifecycle hooks; the behavior fires when the operator runs the CLI.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-016493",
            "import_time": "2026-08-06T14:19:52.231652611Z",
            "sha256": "006755590b6d2fdb396f9ddb138f7c00ebc4bd9ecb870b3267561e70e55ea8d1",
            "modified_time": "2026-08-06T13:40:33Z",
            "versions": [
                "1.2.12"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-016496",
            "import_time": "2026-08-06T14:19:52.340894262Z",
            "sha256": "188fb328579315cdd5a2389776bd63499dd3e06c77b38fc24b2bf4e75d408f03",
            "modified_time": "2026-08-06T13:40:57Z",
            "versions": [
                "1.2.11"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-016494",
            "import_time": "2026-08-06T14:19:52.26598732Z",
            "sha256": "2247b4e7c99823dd666d1f9436504a3b757de5941121ff6702b3909bc70a9f63",
            "modified_time": "2026-08-06T13:40:41Z",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-016495",
            "import_time": "2026-08-06T14:19:52.305990777Z",
            "sha256": "4ca250d88587f6bd31710da3b621a944d9ada2792610e31fdaef60e55e152179",
            "modified_time": "2026-08-06T13:40:49Z",
            "versions": [
                "1.1.0"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-016485",
            "import_time": "2026-08-06T14:19:51.775618278Z",
            "sha256": "8ed4b5323512272a66a7a860c231bce2a86205e4bfa5e5d1309fbf7caf705400",
            "modified_time": "2026-08-06T13:39:18Z",
            "versions": [
                "1.2.8"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-016491",
            "import_time": "2026-08-06T14:19:52.044953861Z",
            "sha256": "990fe474db39f6565c44b22175f8a89cdd90e88a913f92e7e62d4b4840c617f9",
            "modified_time": "2026-08-06T13:40:12Z",
            "versions": [
                "1.2.2"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-016487",
            "import_time": "2026-08-06T14:19:51.878502481Z",
            "sha256": "9ab3edd366f7dfd9c00b9d1caa1a409077ebd99fffa875f7839a0d58ccd043d3",
            "modified_time": "2026-08-06T13:39:34Z",
            "versions": [
                "1.2.9"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-016497",
            "import_time": "2026-08-06T14:19:52.41818978Z",
            "sha256": "f79ef019d6fa2f40aaeeba1fb903dd2aca854b73915f4cc4e616919b781e3108",
            "modified_time": "2026-08-06T13:41:04Z",
            "versions": [
                "1.2.10"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-016488",
            "import_time": "2026-08-06T14:19:51.922425119Z",
            "sha256": "f7f3c5974cbe44835680d0f2cbc3eb6af69914647b098037fe674f9a8f094dfe",
            "modified_time": "2026-08-06T13:39:45Z",
            "versions": [
                "1.2.6"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-016490",
            "import_time": "2026-08-06T14:19:52.002722581Z",
            "sha256": "068cd7ec9976d035121953828e91137d5dc9124fb8cce25517b60126b417b33e",
            "modified_time": "2026-08-06T13:40:04Z",
            "versions": [
                "1.2.3"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-016489",
            "import_time": "2026-08-06T14:19:51.968669564Z",
            "sha256": "bdc44d9f879ce07c857e122c24664d6ae0445cb55aceeeb12c898d65898f7617",
            "modified_time": "2026-08-06T13:39:54Z",
            "versions": [
                "1.2.4"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-016484",
            "import_time": "2026-08-06T14:19:51.747771679Z",
            "sha256": "c6a020101e6fc72ab6b8ba0e6fe75933c0401c21beedca849f711ca5f8d1f63c",
            "modified_time": "2026-08-06T13:39:10Z",
            "versions": [
                "1.2.0"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-016492",
            "import_time": "2026-08-06T14:19:52.118299768Z",
            "sha256": "d39fef25ebfb2e0eabad34d0914ac8daddd2a6588ff700f504eff6d06bca270a",
            "modified_time": "2026-08-06T13:40:23Z",
            "versions": [
                "1.2.7"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / @aubea/mars

Package

Name
@aubea/mars
View open source insights on deps.dev
Purl
pkg:npm/%40aubea/mars

Affected ranges

Affected versions

1.*
1.0.0
1.1.0
1.2.0
1.2.2
1.2.3
1.2.4
1.2.6
1.2.7
1.2.8
1.2.9
1.2.10
1.2.11
1.2.12

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-j7EA5wEUftoQE3qYoYCRTdsdCHOfQ66A8LBJW2nR7ZA5/K7Xp4/fP4j7vqIcHMeDTaDGaiS23+nrvoiSchJt6g==",
                "sha1": "40dacfc9589b41a73ca8343f81c230202743cfb4"
            },
            "filename": "mars-1.2.12.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "dist/mars.mjs",
            "sha256": "493c2b9ca1717d94e67c7c8f819b87a3c6f2ac8f53a0f2bcb626dd4164572709",
            "tlsh": "ecf33a01b3a9657647ecb3d168bf4606b3b488745408440eb778d8ee5bacd82e1bef74"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@aubea/mars/MAL-2026-13415.json"