MAL-2026-11997

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sextant-cli-darwin-arm64/MAL-2026-11997.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-11997

Published

2026-08-05T00:00:26Z

Modified

2026-08-06T13:34:44.457055187Z

Summary

Malicious code in sextant-cli-darwin-arm64 (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (23978b08a7e3f8af97d2c8060e7fc3aca9a18d9f3435163a9d3ab97ac0b9d4d0)

Package ships a darwin/arm64 Go binary that opens an outbound WebSocket to a hardcoded author-controlled relay at wss://relay.sextant.top and links a PTY library (github.com/creack/pty) with a WebSocket client (github.com/coder/websocket), implementing the network-driven pseudo-terminal remote-shell pattern that yields full-host code execution to the operator of that relay. The binary additionally binds listeners on 0.0.0.0:7280, 0.0.0.0:7281, and 0.0.0.0:9000 (a 'ws://%s:%s%s' format string is present), exposing the PTY/WebSocket surface to the local network rather than loopback. Embedded strings include a regex specifically matching Anthropic API keys ('sk-ant-[a-z0-9]+-[A-Za-z0-9_-]{40,}') and references to CLAUDECONFIGDIR and ~/.claude paths, allowing extraction of the installer's Anthropic credentials, which are then reachable via the same relay channel. A separate POST to https://relay.sextant.top/install combined with a call to http://ip-api.com/json/?fields=status,message,country,countryCode,city,timezone,query reports installer geolocation and host identity to the author. The npm-facing metadata describes the package only as 'Sextant (sxt) binary for darwin/arm64', while the license field points to a GitHub repository named 'claude_control' — the shipped functionality (remote control of Claude Code / Gemini CLI sessions plus API-key exfiltration) is not disclosed in the package description or README.

Database specific

{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T00:04:39.161614209Z",
            "modified_time": "2026-08-05T00:00:26Z",
            "sha256": "395a381c321ebe4cfb276cf354d97d45a8fde8f9882b2d31471a7d6ac5e74229",
            "id": "IN-MAL-2026-011364",
            "versions": [
                "0.0.1-rc24"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:27:57.49506179Z",
            "modified_time": "2026-08-05T08:34:51Z",
            "sha256": "fe24e808955cc8fd67f5c49e25eb24e793a7638822d4ad9f949df84ec84f3537",
            "id": "IN-MAL-2026-014329",
            "versions": [
                "0.0.1-rc31"
            ],
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T08:38:03Z",
            "sha256": "7cc2139b9e4cf2fd1d80734e23a313d5c61619b1f59c5507dd8a43f7974fb9eb",
            "id": "IN-MAL-2026-014351",
            "versions": [
                "0.0.1-rc14"
            ],
            "import_time": "2026-08-05T09:28:00.144332153Z"
        },
        {
            "import_time": "2026-08-05T09:27:59.509200154Z",
            "modified_time": "2026-08-05T08:37:08Z",
            "sha256": "a1efc69e5b83ae30eeac5281e41f7d1b47ef27d8554ceea4cd7c4ed2eb327e05",
            "id": "IN-MAL-2026-014345",
            "versions": [
                "0.0.1-rc19"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:27:58.892636071Z",
            "modified_time": "2026-08-05T08:36:18Z",
            "sha256": "d278b0e3fdda4a2c0d2e31d568f22c433ff5eca932b0c898c157c560c7ed94fe",
            "id": "IN-MAL-2026-014339",
            "versions": [
                "0.0.1-rc23"
            ],
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T08:33:04Z",
            "sha256": "d558a19027d65b843f291d6a75281072acdd80bbbb7fa0e4b406e35e7232071a",
            "id": "IN-MAL-2026-014317",
            "versions": [
                "0.0.1-rc25"
            ],
            "import_time": "2026-08-05T09:27:56.128259373Z"
        },
        {
            "import_time": "2026-08-05T09:27:53.528623118Z",
            "modified_time": "2026-08-05T08:30:12Z",
            "sha256": "0b9b792dd92c4c7527463c7b8a8b634d042e236b10a228e920d6a45120906d2b",
            "id": "IN-MAL-2026-014298",
            "versions": [
                "0.0.1-rc35"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:27:59.743812417Z",
            "modified_time": "2026-08-05T08:37:28Z",
            "sha256": "3b0e9f87f2dbf8fab835b00e3a5331455d95e9ce534165edef5a384c297bbd43",
            "id": "IN-MAL-2026-014347",
            "versions": [
                "0.0.1-rc17"
            ],
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T08:31:48Z",
            "sha256": "5d91d56d74ad284c31e231c17e7ca081186a03f1bfec1340aa13154003155537",
            "id": "IN-MAL-2026-014308",
            "versions": [
                "0.0.1-rc16"
            ],
            "import_time": "2026-08-05T09:27:55.082460923Z"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T08:36:44Z",
            "sha256": "20e80ba76f59ca7b25d466ed171d3ef047f5dee1decc0a76441c39094dc6c799",
            "id": "IN-MAL-2026-014342",
            "versions": [
                "0.0.1-rc21"
            ],
            "import_time": "2026-08-05T09:27:59.217636293Z"
        },
        {
            "import_time": "2026-08-05T09:27:55.214379512Z",
            "sha256": "23978b08a7e3f8af97d2c8060e7fc3aca9a18d9f3435163a9d3ab97ac0b9d4d0",
            "modified_time": "2026-08-05T08:31:55Z",
            "id": "IN-MAL-2026-014309",
            "versions": [
                "0.0.1-rc15"
            ],
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T08:30:44Z",
            "sha256": "bcc8ebc32e36b33b2e18804b02316a4a46b093350f921df3fe9a8fe58fb42de0",
            "id": "IN-MAL-2026-014301",
            "versions": [
                "0.0.1-rc20"
            ],
            "import_time": "2026-08-05T09:27:53.91310724Z"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T08:30:23Z",
            "sha256": "cdbbab7489dd57c388d183f453f3aa0d2744e90b9c77beff91229f4e10a13691",
            "id": "IN-MAL-2026-014299",
            "versions": [
                "0.0.1-rc28"
            ],
            "import_time": "2026-08-05T09:27:53.667126652Z"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T08:29:31Z",
            "sha256": "02c7c9fa5c471e1b4d08ca15bef1f7b3285e27866497342edefbb42a01d7fe95",
            "id": "IN-MAL-2026-014293",
            "versions": [
                "0.0.1-rc13"
            ],
            "import_time": "2026-08-05T09:27:52.908447242Z"
        },
        {
            "import_time": "2026-08-05T09:28:02.43771341Z",
            "modified_time": "2026-08-05T08:39:51Z",
            "sha256": "0afccffdcebb26b06812f5698aa5b21d9484608e3906b71580bb49ab5c6d163b",
            "id": "IN-MAL-2026-014364",
            "versions": [
                "0.0.1-rc6"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:27:55.956205233Z",
            "modified_time": "2026-08-05T08:32:54Z",
            "sha256": "c1946cf5905f62b2c8b4ffc3a6046fccc1e852ef2636b4148f6ac6736744ba4b",
            "id": "IN-MAL-2026-014316",
            "versions": [
                "0.0.1-rc34"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:27:58.131994107Z",
            "modified_time": "2026-08-05T08:35:29Z",
            "sha256": "1da3a3ca217ef4134a6cf2f710574df2916265e418742da8387430b14adcf186",
            "id": "IN-MAL-2026-014333",
            "versions": [
                "0.0.1-rc27"
            ],
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T08:28:33Z",
            "sha256": "9cbd61c6b3244c1369cf688b99515e4e0efdb2675d27361d622e89d2ba80e460",
            "id": "IN-MAL-2026-014287",
            "versions": [
                "0.0.1-rc33"
            ],
            "import_time": "2026-08-05T09:27:51.865639415Z"
        },
        {
            "import_time": "2026-08-05T09:28:02.775908138Z",
            "modified_time": "2026-08-05T08:40:16Z",
            "sha256": "aa7cfbb5dea81433df5584af6676fff3950e05d87d0f4309c42e258dae35266a",
            "id": "IN-MAL-2026-014367",
            "versions": [
                "0.0.1-rc5"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:27:56.919090444Z",
            "modified_time": "2026-08-05T08:34:03Z",
            "sha256": "cb8053e951a495b51087f12e7e10dd73bafe49efdc7509057155888d4f30190a",
            "id": "IN-MAL-2026-014324",
            "versions": [
                "0.0.1-rc9"
            ],
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T08:31:04Z",
            "sha256": "0d24fa0a5bc9680270d1a745260d99e8d70d1da2ee89cd42457bdc90cab48674",
            "id": "IN-MAL-2026-014303",
            "versions": [
                "0.0.1-rc29"
            ],
            "import_time": "2026-08-05T09:27:54.200721489Z"
        },
        {
            "import_time": "2026-08-05T09:27:53.014638582Z",
            "modified_time": "2026-08-05T08:29:40Z",
            "sha256": "157282dcd0238cf5bb765c8207dab98bf9270e09fe6f200d97dec894de70c230",
            "id": "IN-MAL-2026-014294",
            "versions": [
                "0.0.1-rc12"
            ],
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T08:39:15Z",
            "sha256": "515bea46c6ee2095b2d8ba6d5355926978b5ea010f4e66d04c358070f95b405c",
            "id": "IN-MAL-2026-014360",
            "versions": [
                "0.0.1-rc8"
            ],
            "import_time": "2026-08-05T09:28:02.072507812Z"
        },
        {
            "import_time": "2026-08-05T09:27:51.644520605Z",
            "modified_time": "2026-08-05T08:28:15Z",
            "sha256": "53d7954fe0abd303d9a9034aefa2df24d506cd27bc83a16b20f95c28b24fcffc",
            "id": "IN-MAL-2026-014285",
            "versions": [
                "0.0.1-rc30"
            ],
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T08:33:19Z",
            "sha256": "73861bb4f7119d8a4cff739f67384c5baa4dd41dca7fbb137b299ca236fa6e24",
            "id": "IN-MAL-2026-014319",
            "versions": [
                "0.0.1-rc32"
            ],
            "import_time": "2026-08-05T09:27:56.382637667Z"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T08:33:38Z",
            "sha256": "803c21c3f3f283d59cfa13eb9fdf06042237995e77f0095045f705f93226105c",
            "id": "IN-MAL-2026-014321",
            "versions": [
                "0.0.1-rc22"
            ],
            "import_time": "2026-08-05T09:27:56.595709157Z"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T08:35:38Z",
            "sha256": "b49a09c9c3ddcfddb9bcf9a0e6ea158dde495807d76afad99416712856d6075f",
            "id": "IN-MAL-2026-014334",
            "versions": [
                "0.0.1-rc26"
            ],
            "import_time": "2026-08-05T09:27:58.239449531Z"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T08:30:05Z",
            "sha256": "a81a5a804a361c18d68d767bda893706722ae036bd3c97d1013d39d1454750d7",
            "id": "IN-MAL-2026-014297",
            "versions": [
                "0.0.1-rc7"
            ],
            "import_time": "2026-08-05T09:27:53.402937148Z"
        },
        {
            "import_time": "2026-08-05T09:27:55.637958382Z",
            "modified_time": "2026-08-05T08:32:31Z",
            "sha256": "75279ebcf38d9a2b62acb5543ee5c5a6243d38d8477b8b1b042808e1e14c2e87",
            "id": "IN-MAL-2026-014313",
            "versions": [
                "0.0.1-rc11"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:27:55.734788265Z",
            "sha256": "fe9287cf6fe34e95a771fb938c74ba8690e2da0de4e012ec1968c9089807608d",
            "modified_time": "2026-08-05T08:32:41Z",
            "id": "IN-MAL-2026-014314",
            "versions": [
                "0.0.1-rc10"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T20:07:26.572865956Z",
            "sha256": "197145c949835b27b6a507c0ef3f59556a786aedc1eb1416a3161db03e200218",
            "modified_time": "2026-08-05T19:50:05Z",
            "id": "IN-MAL-2026-015887",
            "versions": [
                "0.0.1-rc37"
            ],
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T12:56:07Z",
            "sha256": "a6e1849e1f38f846328f7834b1002f6ea618302c51c4f89927abbf814e012ab4",
            "id": "IN-MAL-2026-016267",
            "versions": [
                "0.0.1-rc36"
            ],
            "import_time": "2026-08-06T13:09:08.624374784Z"
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / sextant-cli-darwin-arm64

Package

Name: sextant-cli-darwin-arm64; View open source insights on deps.dev
Purl: pkg:npm/sextant-cli-darwin-arm64

Affected ranges

Affected versions

0.*

0.0.1-rc10

0.0.1-rc11

0.0.1-rc12

0.0.1-rc13

0.0.1-rc14

0.0.1-rc15

0.0.1-rc16

0.0.1-rc17

0.0.1-rc19

0.0.1-rc20

0.0.1-rc21

0.0.1-rc22

0.0.1-rc23

0.0.1-rc24

0.0.1-rc25

0.0.1-rc26

0.0.1-rc27

0.0.1-rc28

0.0.1-rc29

0.0.1-rc30

0.0.1-rc31

0.0.1-rc32

0.0.1-rc33

0.0.1-rc34

0.0.1-rc35

0.0.1-rc36

0.0.1-rc37

0.0.1-rc5

0.0.1-rc6

0.0.1-rc7

0.0.1-rc8

0.0.1-rc9

Database specific

cwes

[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]

indicators

{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-qHQr/YA0NQL/MdPxIeoCrU57aWVlcsUIm5zgDG+jQNkHHGYe4QVuTTUw5sf44p+pcSw+RFfBYAfcRJKCPHZVYg==",
                "sha1": "08ab181aebc8bba297cf84127aa38dc09c300dd5"
            },
            "filename": "sextant-cli-darwin-arm64-0.0.1-rc24.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "bin/sxt",
            "sha256": "9120db82450629ee5220196d7b15d035f99aeb05225a62e1136086efaaee5d24",
            "tlsh": "7bc67c45bc1d6562cac9b6316f7653947338bc448b81c7271628bb3dbef27858f232a1"
        },
        {
            "path": "package.json",
            "sha256": "52c09e519516de27a66a384d20fafd91ae5fd37467612a8b2066ed97133071a0",
            "tlsh": "d7d0a750466461b31de857e08d72b00da3304c991c46744c2f6b754c126e4a29bf6224"
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sextant-cli-darwin-arm64/MAL-2026-11997.json"