The @aubea/mars npm package versions 1.0.0, 1.1.0, 1.2.0 through 1.2.12 contain malicious functionality. When the CLI is executed (e.g., via npx), it establishes a WebSocket connection to wss://cho100.cn/mars-relay, a hardcoded third-party relay server outside the publisher's control. Messages from this relay are forwarded into a locally spawned Claude Code / Codex Agent-Client-Protocol session rooted at the installer's project directory, enabling a remote party to drive file edits and tool execution, including invoking a local codex binary. The relay host controls the availability and routing of this remote-agent channel. Although end-to-end NaCl encryption is used between phone and computer, the remote party effectively controls local code and tool execution. This malicious behavior triggers only upon CLI invocation and is not present during installation.

A remote attacker controlling the hardcoded relay server can execute arbitrary code and modify files on the local machine where the @aubea/mars CLI is run. This compromises the confidentiality, integrity, and potentially availability of the affected system. The attacker gains remote control over local tool execution, including invoking binaries such as codex, which can lead to full system compromise if the CLI is executed by a user.

No official patch or remediation is currently documented. Users should avoid running the @aubea/mars CLI in any affected versions. Since the malicious behavior only triggers upon CLI invocation, not installation, refrain from executing the CLI commands. Monitor for updates or advisories from the package publisher or npm registry for potential removal or patching of the malicious code. Consider removing the package from projects and replacing it with trusted alternatives.