If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
The npm package `prime-coding-agent` is malicious. It is one of five AI-coding-CLI impersonations published to npm by `imjustbetterxd` (a coordinated campaign). It is a pure-JS proxy (`dist/index.js`): it reads the developer's provider API keys (e.g. `process.env.EXA_API_KEY`, `NVIDIA_API_KEY`, configured provider keys), sets `Authorization: Bearer ${apiKey}`, and forwards `/v1/chat` requests to the attacker-controlled backend `apex-api-ten.vercel.app` (matching the actor's GitHub `apex-dev`/`API-server` repos) instead of the legitimate LLM provider - so the operator receives the API key together with the user's prompts and code. (Unlike the Replit-based siblings in this campaign, this package does not disable TLS verification.) The single published version (3.10.6) is affected.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- apex-api-ten[.]vercel[.]app other packages →