{"id":"MAL-2026-12043","summary":"Malicious code in sextant-cli-linux-arm64 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fc34f69b5a68c549feccfb32cc2dbfbf2d4c787a4876241027b4299305fd2c53)\nThe package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt. The package.json omits repository, author, main, bin, files, and scripts fields, and its license field points at github.com/ddos798/claude_control — a self-labeled 'claude_control' project. Strings in bin/sxt reveal a full WebRTC stack (pion/webrtc/v4, pion/turn/v5, pion/ice/v4, coder/websocket, go-qrcode) plus a hardcoded signaling/relay endpoint https://relay.sextant.top/install, giving the binary the shape of a remote-control agent that pairs the installer's host to an author-controlled peer over WebRTC data channels. Adjacent strings 'sk-ant-', 'CLAUDE_CONFIG_DIR', 'https://api.anthropic.com/v1/models', 'https://claude.ai/install.sh', and '@google/gemini-cli' show the binary is positioned to read Anthropic API keys and Claude Code / Gemini CLI configuration from the installer and hand them to the remote peer through the established channel. An additional string http://ip-api.com/json/ provides public-IP geolocation of the host for the remote operator. The combination of an opaque metadata-only npm manifest, a bundled native binary embedding a full peer-to-peer control stack, a hardcoded author relay, and embedded references to developer AI-credential material is a backdoor with credential-theft capability against the installer.\n","modified":"2026-08-07T13:21:00.512393083Z","published":"2026-08-05T00:57:42Z","database_specific":{"malicious-packages-origins":[{"sha256":"418037e9b31b644112b260f94ff33361fb14089cfa986a2e1b3b790f5e1efa9c","source":"amazon-inspector","versions":["0.0.1-rc12"],"id":"IN-MAL-2026-011485","import_time":"2026-08-05T01:39:31.069707504Z","modified_time":"2026-08-05T01:04:47Z"},{"id":"IN-MAL-2026-011486","import_time":"2026-08-05T01:39:31.115046478Z","modified_time":"2026-08-05T01:05:17Z","sha256":"5154aac3c250efe54db62ca5d643d257041199d7abb72fe061db7d4e472d02b1","source":"amazon-inspector","versions":["0.0.1-rc11"]},{"modified_time":"2026-08-05T01:02:30Z","sha256":"cb7ff319c462df37238c84a4d224ed57bb0020dba780f8b41b44705e479744b1","source":"amazon-inspector","versions":["0.0.1-rc25"],"id":"IN-MAL-2026-011481","import_time":"2026-08-05T01:39:30.888093054Z"},{"sha256":"4625bc910b50e9ab5ce1584e968f36b48ac0a3cee072c0bfb3bee9602e33a8ab","source":"amazon-inspector","versions":["0.0.1-rc29"],"id":"IN-MAL-2026-011474","import_time":"2026-08-05T01:39:30.610014783Z","modified_time":"2026-08-05T00:57:42Z"},{"sha256":"40aae1ad3e070677d2994912ce2b716755f44d1624ec5783dcdfed76ddc99a01","source":"amazon-inspector","versions":["0.0.1-rc19"],"id":"IN-MAL-2026-014346","import_time":"2026-08-05T09:27:59.631721312Z","modified_time":"2026-08-05T08:37:16Z"},{"versions":["0.0.1-rc20"],"id":"IN-MAL-2026-014343","import_time":"2026-08-05T09:27:59.325349718Z","modified_time":"2026-08-05T08:36:52Z","sha256":"6bceee78c4f7d7d00f951f62ce70f492ca326062c5322db0cc1d4fa764425d99","source":"amazon-inspector"},{"import_time":"2026-08-05T09:28:02.879845766Z","modified_time":"2026-08-05T08:40:22Z","sha256":"794a709a94cfcad6d856d1a0f61c22b0bf87a82bfed35fc316317b5bc241706a","source":"amazon-inspector","versions":["0.0.1-rc32"],"id":"IN-MAL-2026-014368"},{"import_time":"2026-08-05T09:27:59.8444492Z","modified_time":"2026-08-05T08:37:39Z","sha256":"80741f7308bb0a773ba5d253d5758418b281c6f52bd76f3539d543af90965182","source":"amazon-inspector","versions":["0.0.1-rc18"],"id":"IN-MAL-2026-014348"},{"import_time":"2026-08-05T09:28:03.083260422Z","modified_time":"2026-08-05T08:40:42Z","sha256":"9091ae60e8aa113b83f3f75134a174dcab691574dd0377f1c4243b4707fc1b54","source":"amazon-inspector","versions":["0.0.1-rc16"],"id":"IN-MAL-2026-014370"},{"versions":["0.0.1-rc10"],"id":"IN-MAL-2026-014380","import_time":"2026-08-05T09:28:04.414309184Z","modified_time":"2026-08-05T08:42:05Z","sha256":"f769878c746b1fe9596d5de053cdc5d1e0a5b66cd4207095a3e82a6d0d01caee","source":"amazon-inspector"},{"modified_time":"2026-08-05T08:39:09Z","sha256":"02b65da196043b5f6fa34edb6cc2493d481f58f07af53c82ded5579bc119beae","source":"amazon-inspector","versions":["0.0.1-rc8"],"id":"IN-MAL-2026-014359","import_time":"2026-08-05T09:28:01.979094816Z"},{"sha256":"24e50a2ebf918c72248b1466d84553c98be7f02f5b5eeb1542492a62d1dc43cf","source":"amazon-inspector","versions":["0.0.1-rc17"],"id":"IN-MAL-2026-014384","import_time":"2026-08-05T09:28:04.801848774Z","modified_time":"2026-08-05T08:42:35Z"},{"import_time":"2026-08-05T09:27:58.712924869Z","modified_time":"2026-08-05T08:36:02Z","sha256":"65bdb3b695578f85c0960efee3ed4905d494c84a3ee531621ee1ffacc626a5e0","source":"amazon-inspector","versions":["0.0.1-rc26"],"id":"IN-MAL-2026-014337"},{"modified_time":"2026-08-05T08:41:31Z","sha256":"a68cb00b38e32b20b6b3dd1e8924bda83aed0b0ab7fb818cc7def59fe46e1b03","source":"amazon-inspector","versions":["0.0.1-rc21"],"id":"IN-MAL-2026-014376","import_time":"2026-08-05T09:28:03.862266307Z"},{"versions":["0.0.1-rc30"],"id":"IN-MAL-2026-014328","import_time":"2026-08-05T09:27:57.303253238Z","modified_time":"2026-08-05T08:34:41Z","sha256":"b913310a2ee8bccdb21b116744f384fb0c7eee3cab368bd850b6934715704708","source":"amazon-inspector"},{"sha256":"fc34f69b5a68c549feccfb32cc2dbfbf2d4c787a4876241027b4299305fd2c53","source":"amazon-inspector","versions":["0.0.1-rc15"],"id":"IN-MAL-2026-014352","import_time":"2026-08-05T09:28:00.364278951Z","modified_time":"2026-08-05T08:38:13Z"},{"source":"amazon-inspector","versions":["0.0.1-rc14"],"id":"IN-MAL-2026-014354","import_time":"2026-08-05T09:28:00.958997412Z","modified_time":"2026-08-05T08:38:29Z","sha256":"0b912d4062490cae96d4eb8d1b6fe79fbcc753d63d1ce687c2b365c968042bd9"},{"import_time":"2026-08-05T09:27:58.976957083Z","modified_time":"2026-08-05T08:36:27Z","sha256":"1d37d85890962b7e7964808b7f350f10580bd199a84ac7bf70a94190f7bdba39","source":"amazon-inspector","versions":["0.0.1-rc24"],"id":"IN-MAL-2026-014340"},{"id":"IN-MAL-2026-014325","import_time":"2026-08-05T09:27:57.020263056Z","modified_time":"2026-08-05T08:34:14Z","sha256":"4d76f3e22b3e21346682943b7ae07255765af6464f47b398958ed010de1887cb","source":"amazon-inspector","versions":["0.0.1-rc33"]},{"import_time":"2026-08-05T09:28:00.623794766Z","modified_time":"2026-08-05T08:38:20Z","sha256":"663e9bff9653a348f5b6bd01b9a914442335cb8f29d886257508d02e2809faa3","source":"amazon-inspector","versions":["0.0.1-rc13"],"id":"IN-MAL-2026-014353"},{"versions":["0.0.1-rc22"],"id":"IN-MAL-2026-014383","import_time":"2026-08-05T09:28:04.71125622Z","modified_time":"2026-08-05T08:42:28Z","sha256":"8c822da26354b84c353e24370847616465100024645ecea2428dcd9c9508bd9c","source":"amazon-inspector"},{"modified_time":"2026-08-05T08:36:11Z","sha256":"be89ba2dff50dd7f82f3f253c093f206b938047963f3b3d632c3481cd0af2ee8","source":"amazon-inspector","versions":["0.0.1-rc23"],"id":"IN-MAL-2026-014338","import_time":"2026-08-05T09:27:58.800161709Z"},{"source":"amazon-inspector","versions":["0.0.1-rc7"],"id":"IN-MAL-2026-014358","import_time":"2026-08-05T09:28:01.860046852Z","modified_time":"2026-08-05T08:39:02Z","sha256":"f691736954a0be654ddb160f464ea1532b0ce07b6153c663303324a5f1062244"},{"versions":["0.0.1-rc5"],"id":"IN-MAL-2026-014365","import_time":"2026-08-05T09:28:02.556271337Z","modified_time":"2026-08-05T08:40:00Z","sha256":"2a1160b86f511d06fffa7aefc8eada7a25d76c10d2d403a0ce5535f94e9133ca","source":"amazon-inspector"},{"id":"IN-MAL-2026-014382","import_time":"2026-08-05T09:28:04.625148534Z","modified_time":"2026-08-05T08:42:21Z","sha256":"6e06cc13a704d66a247c91063fdcb5d7f0f4024371ac8e3ca2e69f5767ab024c","source":"amazon-inspector","versions":["0.0.1-rc28"]},{"id":"IN-MAL-2026-014326","import_time":"2026-08-05T09:27:57.108741829Z","modified_time":"2026-08-05T08:34:22Z","sha256":"7db22c238993ce482f2695a826b8de1b1184f9737599621f29155fd290ef745c","source":"amazon-inspector","versions":["0.0.1-rc35"]},{"id":"IN-MAL-2026-014371","import_time":"2026-08-05T09:28:03.226185948Z","modified_time":"2026-08-05T08:40:50Z","sha256":"85ca631bc3fb1aa563a2e2e6a73e06346e7f056bafef77c072006e2f3ef6a204","source":"amazon-inspector","versions":["0.0.1-rc31"]},{"sha256":"d2d8dc2926c4bab62527ab1d2875d0b421eb0e21fcd5d44246db63fbcbd50460","source":"amazon-inspector","versions":["0.0.1-rc36"],"id":"IN-MAL-2026-015822","import_time":"2026-08-05T16:13:49.801122369Z","modified_time":"2026-08-05T16:10:12Z"},{"import_time":"2026-08-07T12:51:24.300574564Z","modified_time":"2026-08-07T12:37:48Z","sha256":"c0e36e15aea773cf6e9477eeb3d71a04cbdfd34f2b1bc1bec0696eca18de9565","source":"amazon-inspector","versions":["0.0.1-rc38"],"id":"IN-MAL-2026-017058"},{"import_time":"2026-08-07T12:51:24.220484465Z","modified_time":"2026-08-07T12:37:23Z","sha256":"a206f5ec3c93cf6f391e9e5c8667338a3f3af15567cd6e01e819f9c01686c042","source":"amazon-inspector","versions":["0.0.1-rc39"],"id":"IN-MAL-2026-017055"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc12"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc11"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc25"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc29"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc19"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc20"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc32"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc18"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc16"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc10"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc8"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc17"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc26"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc21"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc30"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc15"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc14"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc24"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc33"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc13"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc22"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc23"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc28"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc35"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc31"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc36"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc38"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc39"}],"affected":[{"package":{"name":"sextant-cli-linux-arm64","ecosystem":"npm","purl":"pkg:npm/sextant-cli-linux-arm64"},"versions":["0.0.1-rc12","0.0.1-rc11","0.0.1-rc25","0.0.1-rc29","0.0.1-rc19","0.0.1-rc20","0.0.1-rc32","0.0.1-rc18","0.0.1-rc16","0.0.1-rc10","0.0.1-rc8","0.0.1-rc17","0.0.1-rc26","0.0.1-rc21","0.0.1-rc30","0.0.1-rc15","0.0.1-rc14","0.0.1-rc24","0.0.1-rc33","0.0.1-rc13","0.0.1-rc22","0.0.1-rc23","0.0.1-rc7","0.0.1-rc5","0.0.1-rc28","0.0.1-rc35","0.0.1-rc31","0.0.1-rc36","0.0.1-rc38","0.0.1-rc39"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sextant-cli-linux-arm64/MAL-2026-12043.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"sha256":"bb6643f21fe469f3aecbcd764906f3473121994a45d2577088cd42309cf2389d","tlsh":"ebc66c55bc1db5a2daca75306b661394b238bc084b92c7176718bb3df9f2784cf132a1","path":"bin/sxt"},{"path":"package.json","sha256":"2234fb1f2b224646e07d0115380f3f35ff66c69215d51404962270b8616a4919","tlsh":"2ed0a751042401b319e857e45e21f00daa308de994457808af6b764d022d5726bb76a9"}],"package_integrity":[{"filename":"sextant-cli-linux-arm64-0.0.1-rc12.tgz","hashes":{"sha512_sri":"sha512-YRQa1Azp76d6Al9PgLBPRAoNtKVBqmDuS6zCVVocObFwJ7q6Fx3CuKpLgIMCnsROLBYBqtMOUTKLlhAi+Ua6rw==","sha1":"57e7fe935798ca4c899f6334f255ee9d28b200d5"}}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}