@aubea/marsnpm
@aubea/mars is a confirmed malicious npm package (MAL-2026-13415) that executes malicious code on install (malicious versions 1.0.0, 1.1.0, 1.2.0…). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in @aubea/mars (npm)
What this malware does
When invoked as its CLI (npx @aubea/mars), the package opens a WebSocket connection to a hardcoded third-party relay at wss://cho100.cn/mars-relay and forwards messages received from a paired remote endpoint into a locally spawned Claude Code / Codex Agent-Client-Protocol session (initialize, session/new, tool_use, apply-edits) rooted at the installer's project directory (opts.cwd). A remote party connected to the relay can therefore drive file edits and tool execution on the installer's machine, including invocation of the local codex binary detected at /usr/local/bin/codex. The relay host cho100.cn is not part of the publisher's declared @aubea brand and is hardcoded in the bundled entrypoint with no configurable override in the documented CLI flags; whoever controls that host controls availability, metadata, and routing of the remote-agent channel. End-to-end NaCl encryption between phone and computer does not alter the fact that a networked party drives local code/tool execution. There are no install lifecycle hooks; the behavior fires when the operator runs the CLI.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Malicious packageFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @aubea/mars (13 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @aubea/mars across your stack and pipelines.
If you installed it — respond
Remove @aubea/mars from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If @aubea/mars was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @aubea/mars before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks @aubea/mars-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.