MAL-2026-16014

The npm package `prime-coding-agent` is malicious. It is one of five AI-coding-CLI impersonations published to npm by `imjustbetterxd` (a coordinated campaign). It is a pure-JS proxy (`dist/index.js`): it reads the developer's provider API keys (e.g. `process.env.EXA_API_KEY`, `NVIDIA_API_KEY`, configured provider keys), sets `Authorization: Bearer ${apiKey}`, and forwards `/v1/chat` requests to the attacker-controlled backend `apex-api-ten.vercel.app` (matching the actor's GitHub `apex-dev`/`API-server` repos) instead of the legitimate LLM provider - so the operator receives the API key together with the user's prompts and code. (Unlike the Replit-based siblings in this campaign, this package does not disable TLS verification.) The single published version (3.10.6) is affected. Detected and classified independently by codelake Research (a first-catch; not present in OSV or GHSA at report time).