NPM Supply Chain - omgvibe AI Tool Config Wizard Execution

How the attack works

A developer runs the package via a package runner such as npx, bunx, or pnpm dlx, or it gets installed as a dependency. The wizard walks the user through prompts, collecting API keys or auth tokens for tools like Claude Code, CodeX, OpenCode, or CodeWhale. It then rewrites those tools' configuration files or environment variables (for example ANTHROPIC_BASE_URL, OPENAI_API_KEY, ~/.codex/config) to point at the OhMyGPT relay instead of the original provider. From that point on, prompts and credentials from the AI coding tool pass through OhMyGPT rather than going directly to the intended vendor.

Netzilo detection

Why it matters

Once reconfigured, an organization's AI coding tool traffic and credentials flow through an unvetted third-party relay, giving that relay visibility into API keys, prompts, and potentially proprietary source code shared with the assistant.

What you can do

• →Check whether 'omgvibe' or any package with the same behavior appears in your npm install history, lockfiles, or node_modules, including vendored copies.
• →Inspect configuration files and environment variables for AI coding tools (~/.codex/config, ~/.claude/settings.json, ANTHROPIC_BASE_URL, OPENAI_BASE_URL, etc.) for unexpected relay endpoints.
• →If you find OhMyGPT configured and did not choose it deliberately, rotate any API keys or auth tokens that may have been entered during the wizard and restore the original endpoint settings.
• →Restrict or review use of ad hoc package runners (npx, bunx, pnpm dlx, yarn dlx) for tools that touch credentials, and require review before running unfamiliar setup wizards.

Known benign look-alikes

• Supply-chain analysts or incident responders detonating omgvibe in a sandbox - an analyst NPX run is byte-identical to a victim run, so this fires and should be closed as authorised research.
• A developer who has deliberately chosen OhMyGPT as their model relay and edits ANTHROPIC_BASE_URL / OPENAI_BASE_URL or ~/.codex/config by hand; the second evidence path (relay endpoint plus agent credential config) matches that too.
• A fork, mirror or vendored copy checked in under node_modules/omgvibe that a build step executes from disk rather than from the registry.
• CI images that pre-warm the npx/npm cache by installing a long package list that happens to include omgvibe.
• Automation that repairs an existing OhMyGPT-backed setup (re-writing the same config file with no new credential entry).

References

• https://attack.mitre.org/techniques/T1195/002/
• https://attack.mitre.org/techniques/T1059/007/
• https://attack.mitre.org/techniques/T1552/

Related threats