{"id":"MAL-2026-13418","summary":"Malicious code in @ccfly/setup-linux-x64 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (33138ee17148f975a7c0b34f5d6ee1a4ad082395b87872dc91de0778130b91c8)\nThe tarball ships a single 6.9 MB linux/x64 Go executable at bin/ccfly-setup and no source. The binary links github.com/creack/pty (PTY spawning) and github.com/gorilla/websocket (WebSocket client), and contains hardcoded destinations ws://ccflycc.hn, wss://, and https://cc.hn along with strings that drive apt-get/pacman/zypper package installs after a remote 'approve' step (including a Chinese status string meaning 'client installed and paired'). This is a remote-controlled shell/executor architecture: a persistent WebSocket to a vendor-controlled server plus a local PTY and privileged package-manager invocations give whoever controls ccflycc.hn / cc.hn full command execution and privileged package installation on the host running the binary. package.json declares only {os:[linux], cpu:[x64], files:[bin]} with no scripts, main, or bin field, so `npm install` does not by itself execute the binary; the backdoor activates when the companion @ccfly/* wrapper CLI resolves this optionalDependency and invokes bin/ccfly-setup. The delivery uses plain ws:// in addition to wss://, and no source is shipped for independent audit.\n","modified":"2026-08-06T14:34:46.549511900Z","published":"2026-08-06T13:51:43Z","database_specific":{"malicious-packages-origins":[{"sha256":"296e1b146603b0e56bada239257839e6c404720a263d3cf467a727397870f022","source":"amazon-inspector","versions":["0.1.4"],"id":"IN-MAL-2026-016528","import_time":"2026-08-06T14:19:53.804217599Z","modified_time":"2026-08-06T13:52:11Z"},{"versions":["0.1.3"],"id":"IN-MAL-2026-016529","import_time":"2026-08-06T14:19:53.837368657Z","modified_time":"2026-08-06T13:52:24Z","sha256":"33138ee17148f975a7c0b34f5d6ee1a4ad082395b87872dc91de0778130b91c8","source":"amazon-inspector"},{"versions":["0.1.9"],"id":"IN-MAL-2026-016526","import_time":"2026-08-06T14:19:53.715108564Z","modified_time":"2026-08-06T13:51:51Z","sha256":"5431775fbfb5393064dfa86e71467919e31bc482ca063b7becb39314dba4ff9f","source":"amazon-inspector"},{"import_time":"2026-08-06T14:19:53.658722047Z","modified_time":"2026-08-06T13:51:43Z","sha256":"b4d7aa40a791ac6747d32cf63e15018433ac384c673c2587d6d7aa1db2889819","source":"amazon-inspector","versions":["0.1.0"],"id":"IN-MAL-2026-016525"},{"import_time":"2026-08-06T14:19:54.026111431Z","modified_time":"2026-08-06T13:52:52Z","sha256":"ccb15b24f68c411ed5952e93adfb149b226298e8812b32a3293308878d87240c","source":"amazon-inspector","versions":["0.1.1"],"id":"IN-MAL-2026-016532"},{"id":"IN-MAL-2026-016533","import_time":"2026-08-06T14:19:54.063680206Z","modified_time":"2026-08-06T13:53:01Z","sha256":"cf67bf381e483cbe273650f4d3af480e113639709c85c6360e7d06388a7b3143","source":"amazon-inspector","versions":["0.1.10"]},{"import_time":"2026-08-06T14:19:54.104307434Z","modified_time":"2026-08-06T13:53:11Z","sha256":"5208fc1432f95ef04a90f0cda3cd92b45196ba8e3358ce0ec36b249ef5b95a01","source":"amazon-inspector","versions":["0.1.17"],"id":"IN-MAL-2026-016534"},{"import_time":"2026-08-06T14:19:53.964501895Z","modified_time":"2026-08-06T13:52:45Z","sha256":"82bc092752f32a5ed0564c69bce8ef621d63ab9b89d5a1b74a00710d66bb4ada","source":"amazon-inspector","versions":["0.1.19"],"id":"IN-MAL-2026-016531"},{"versions":["0.1.14"],"id":"IN-MAL-2026-016527","import_time":"2026-08-06T14:19:53.749459592Z","modified_time":"2026-08-06T13:51:59Z","sha256":"9632eb35be0c9ea25d90fa7dc0fe9ecd4eaa3b44b0fba5616cb399429d032315","source":"amazon-inspector"},{"sha256":"c5b8ba92b0192289b9bd7316dcf6fd8964a52fbbbcf50845208501181917800a","source":"amazon-inspector","versions":["0.1.2"],"id":"IN-MAL-2026-016530","import_time":"2026-08-06T14:19:53.876140322Z","modified_time":"2026-08-06T13:52:37Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.9"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.10"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.17"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.19"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.14"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.2"}],"affected":[{"package":{"name":"@ccfly/setup-linux-x64","ecosystem":"npm","purl":"pkg:npm/%40ccfly/setup-linux-x64"},"versions":["0.1.4","0.1.3","0.1.9","0.1.0","0.1.1","0.1.10","0.1.17","0.1.19","0.1.14","0.1.2"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ccfly/setup-linux-x64/MAL-2026-13418.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"tlsh":"8a664917fca525e9c0ae913189639513bf727c494b3123d35f90ba283f76bd0aab9740","path":"bin/ccfly-setup","sha256":"fa5f9e252b4b2ca17fe3db33e92b8d96585c86eff4bf6be281fec71077b7b867"},{"path":"package.json","sha256":"159efe1f2a326113006d6e651bf4185ba825fb3753a12e8a281107779db9a126","tlsh":"d8d02b214919813316d8eb905c21434d6d100d920190748c8ebf210c512c76159f6af9"}],"package_integrity":[{"filename":"setup-linux-x64-0.1.4.tgz","hashes":{"sha1":"c28f6659398e2b0fb13c219319aacb257cb3ca4d","sha512_sri":"sha512-01v35tGwt/OWOUAsbgha2mAIA1hGdinx8P1mKo3z0QRkG9rBRd7vNg0u3QzSY+BZF/Bs8p46njBSdPd6Hrrm1g=="}}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}