MAL-2026-12028

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sextant-cli-darwin-amd64/MAL-2026-12028.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-12028

Published

2026-08-05T00:09:51Z

Modified

2026-08-05T20:19:48.591314402Z

Summary

Malicious code in sextant-cli-darwin-amd64 (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9d2e5ab6503eb2b9c12bf64e34cb2fe12227c07b179231ebe23f13b8866181f1)

The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main, no bin mapping, and no scripts — the package is a platform-artifact shipped for consumption as an optionalDependency by a parent sextant-cli. Strings extracted from bin/sxt show it embeds github.com/coder/websocket and github.com/creack/pty together with the hardcoded relay URL wss://relay.sextant.top; that network-to-PTY dataflow is a remote-shell backdoor driven by an attacker-controlled WebSocket relay on the installer's host. The same binary contains the Anthropic API-key regex sk-ant-[a-z0-9]+-[A-Za-z0-9_-]{40,} alongside CLAUDECONFIGDIR=, https://claude.ai/, and https://api.anthropic.com/v1/models, indicating the binary reads the installer's Claude configuration directory and fingerprints sk-ant-* credentials for exfiltration through the same relay. Additional strings embed http://ip-api.com/json/?fields=status,message,country,countryCode,city,timezone,isp,org,as,proxy,hosting,mobile,query, profiling the installer's public IP, city, ISP, org, ASN, and hosting/proxy flags. package.json declares its license as SEE LICENSE IN https://github.com/ddos798/claude_control, and the binary references https://claude.ai/install.sh and https://registry.npmjs.org/sextant-cli/latest for self-update. Delivering behavior only as a stripped compiled binary conceals the network-to-PTY, credential-regex, and geolocation logic from JS-level inspection.

Database specific

{
    "malicious-packages-origins": [
        {
            "versions": [
                "0.0.1-rc34"
            ],
            "sha256": "4da71f2071285bfe8543d8aa7437f2b82111d95797f78ece2cf7498d02ff9cc1",
            "import_time": "2026-08-05T00:44:43.406723846Z",
            "id": "IN-MAL-2026-011398",
            "modified_time": "2026-08-05T00:09:51Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc31"
            ],
            "import_time": "2026-08-05T09:27:54.549258643Z",
            "sha256": "8ec015aabfc62dff864495c55a843f27de7ad643be1cd16c847542d2b492276f",
            "id": "IN-MAL-2026-014305",
            "modified_time": "2026-08-05T08:31:19Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc10"
            ],
            "sha256": "beb6fac9ef14e4420488f91db4a3611492970a0391a7ed525f2093e1639cd0d4",
            "import_time": "2026-08-05T09:28:01.709442228Z",
            "id": "IN-MAL-2026-014357",
            "modified_time": "2026-08-05T08:38:55Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc16"
            ],
            "import_time": "2026-08-05T09:27:52.552004509Z",
            "sha256": "cea82d3f63d4bfc12706277fb9b372fb921233bc8e6e7da0df30d2fec4143d45",
            "id": "IN-MAL-2026-014290",
            "modified_time": "2026-08-05T08:29:03Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc11"
            ],
            "sha256": "176744255653f7306997ec4017221942d5262fe934ef6972e55e93ca46fe4272",
            "import_time": "2026-08-05T09:27:56.693937681Z",
            "id": "IN-MAL-2026-014322",
            "modified_time": "2026-08-05T08:33:47Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc12"
            ],
            "import_time": "2026-08-05T09:28:01.512373863Z",
            "sha256": "3c0a77e02596335bf566a31445467cab1dce963b7e753fbc067cc330c82a37cc",
            "id": "IN-MAL-2026-014356",
            "modified_time": "2026-08-05T08:38:45Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc26"
            ],
            "import_time": "2026-08-05T09:27:53.810518245Z",
            "sha256": "b69236fcb44cf363593c779d36704726a28c68d0bf15fc986810575c285c6387",
            "id": "IN-MAL-2026-014300",
            "modified_time": "2026-08-05T08:30:35Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc6"
            ],
            "import_time": "2026-08-05T09:28:02.680037086Z",
            "sha256": "643e2c52a14d58d361874e0746d53c7fba136fc7dd8655bea0e6b12b3f6cc32c",
            "id": "IN-MAL-2026-014366",
            "modified_time": "2026-08-05T08:40:09Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc24"
            ],
            "sha256": "062689c7eb753d43d7319f042585d39b929e14cf0d609da842bc0f35499aab06",
            "import_time": "2026-08-05T09:27:52.703500813Z",
            "id": "IN-MAL-2026-014291",
            "modified_time": "2026-08-05T08:29:10Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc22"
            ],
            "sha256": "7487ed84a2ee2c397adc615962e85086a371e6108378b5298179d73805cb8353",
            "import_time": "2026-08-05T09:27:59.084314448Z",
            "id": "IN-MAL-2026-014341",
            "modified_time": "2026-08-05T08:36:36Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc14"
            ],
            "sha256": "d0a4579ae1dd2ccffaf28302af4e1565775241f9b1d0c5e861df2c8554227c57",
            "import_time": "2026-08-05T09:27:55.420080356Z",
            "id": "IN-MAL-2026-014311",
            "modified_time": "2026-08-05T08:32:12Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc23"
            ],
            "sha256": "e0a1ca6f4e48ee3ee376c62bf04d229eef9b9c28c4d5704aeb01efbf4b963f94",
            "import_time": "2026-08-05T09:27:56.498527746Z",
            "id": "IN-MAL-2026-014320",
            "modified_time": "2026-08-05T08:33:30Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc19"
            ],
            "sha256": "0dbc296faa091033a145f485d51789ead79b91716bb0ddbbbbaec38bcfe990c4",
            "import_time": "2026-08-05T09:27:54.684835284Z",
            "id": "IN-MAL-2026-014306",
            "modified_time": "2026-08-05T08:31:29Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc35"
            ],
            "import_time": "2026-08-05T09:27:53.206722485Z",
            "sha256": "08ab037c781a77b323dc720da773cdbd283b8104a6ceaba93eab09b2dde7644b",
            "id": "IN-MAL-2026-014296",
            "modified_time": "2026-08-05T08:29:55Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc18"
            ],
            "import_time": "2026-08-05T09:27:52.80472926Z",
            "sha256": "52ab46f4de0ab24a68d3cd1db4e6b752e39db8a870a4df1ace5575fdd2400e0f",
            "id": "IN-MAL-2026-014292",
            "modified_time": "2026-08-05T08:29:21Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc20"
            ],
            "sha256": "7c2ffb43db99172500191d797e6c3d6e189dc78b9d5f1973411031d36507d159",
            "import_time": "2026-08-05T09:27:52.323936837Z",
            "id": "IN-MAL-2026-014289",
            "modified_time": "2026-08-05T08:28:50Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc27"
            ],
            "import_time": "2026-08-05T09:27:57.930079975Z",
            "sha256": "9d2e5ab6503eb2b9c12bf64e34cb2fe12227c07b179231ebe23f13b8866181f1",
            "id": "IN-MAL-2026-014332",
            "modified_time": "2026-08-05T08:35:19Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc21"
            ],
            "sha256": "e17a84407d1c8b91240f6eb38704bcf11e7bed3b3ed38c90ac727f5526b7b2d0",
            "import_time": "2026-08-05T09:27:54.370855128Z",
            "id": "IN-MAL-2026-014304",
            "modified_time": "2026-08-05T08:31:11Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc25"
            ],
            "import_time": "2026-08-05T09:27:58.625562327Z",
            "sha256": "ef741ddc2626420bbf83f3b8d99f2c1f22f347e438bb959021dfea8f9d03a3c6",
            "id": "IN-MAL-2026-014336",
            "modified_time": "2026-08-05T08:35:54Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc13"
            ],
            "import_time": "2026-08-05T09:27:55.547916011Z",
            "sha256": "fd14e772b597978bb7f59bf8f2a70d91655099210af716036b9d596a0a99a6c0",
            "id": "IN-MAL-2026-014312",
            "modified_time": "2026-08-05T08:32:23Z",
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "import_time": "2026-08-05T09:27:57.775860551Z",
            "sha256": "38084d2ddef3a61c81d025e654545d07bbba773fb89e04cdadfdd9d82c922011",
            "id": "IN-MAL-2026-014331",
            "modified_time": "2026-08-05T08:35:10Z",
            "versions": [
                "0.0.1-rc28"
            ]
        },
        {
            "versions": [
                "0.0.1-rc7"
            ],
            "sha256": "67e09f48d2a485c796f3872b327e86a5523ee69bb4289fe9e3033f0f3cd43ecf",
            "import_time": "2026-08-05T09:28:02.264416666Z",
            "id": "IN-MAL-2026-014362",
            "modified_time": "2026-08-05T08:39:35Z",
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "import_time": "2026-08-05T09:27:54.043981251Z",
            "sha256": "b703b004ecba01397c378b3e56d9f22d7f4e822c14d3ce58e40513730000952f",
            "id": "IN-MAL-2026-014302",
            "modified_time": "2026-08-05T08:30:54Z",
            "versions": [
                "0.0.1-rc29"
            ]
        },
        {
            "versions": [
                "0.0.1-rc30"
            ],
            "import_time": "2026-08-05T09:27:56.272485198Z",
            "sha256": "4a08fb404b42923ca00d403a2e93d904ed6694ce245a0bb81fc58a21757bfb4b",
            "id": "IN-MAL-2026-014318",
            "modified_time": "2026-08-05T08:33:11Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc17"
            ],
            "import_time": "2026-08-05T09:27:54.950781251Z",
            "sha256": "6d19f5aab58eb6b8a605b2133a9074e474ea395bb78cff25fba0cf57374eba39",
            "id": "IN-MAL-2026-014307",
            "modified_time": "2026-08-05T08:31:38Z",
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "import_time": "2026-08-05T09:27:55.842058771Z",
            "sha256": "8110d0d64570cbfdd0e1b6da8166e5b3e01060908766f038338af489ecaae71d",
            "id": "IN-MAL-2026-014315",
            "modified_time": "2026-08-05T08:32:48Z",
            "versions": [
                "0.0.1-rc8"
            ]
        },
        {
            "versions": [
                "0.0.1-rc33"
            ],
            "sha256": "955711067836acd1442fa265aff200afe40023a7e65f210298bdb87ef8fe1942",
            "import_time": "2026-08-05T09:27:51.741238027Z",
            "id": "IN-MAL-2026-014286",
            "modified_time": "2026-08-05T08:28:23Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc9"
            ],
            "import_time": "2026-08-05T09:27:56.815579759Z",
            "sha256": "b3efc75b637a6953d87fb80a3308ec47fb0a27985c9dc22af68ef082feae9080",
            "id": "IN-MAL-2026-014323",
            "modified_time": "2026-08-05T08:33:55Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc32"
            ],
            "import_time": "2026-08-05T09:27:51.541836677Z",
            "sha256": "c719c58e060f4978dbf3384521ba75e955ee49796c73ef1a26aef224b5c5c565",
            "id": "IN-MAL-2026-014284",
            "modified_time": "2026-08-05T08:28:03Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc5"
            ],
            "sha256": "3e363ee49349bb2fa8d05d057995bb419385be364e1899c71fe51be8f23027b5",
            "import_time": "2026-08-05T09:28:02.979761621Z",
            "id": "IN-MAL-2026-014369",
            "modified_time": "2026-08-05T08:40:29Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc15"
            ],
            "sha256": "77e89f39191222fe553f7ae17512bb9b97566702de7c26c50538a4605e9135f3",
            "import_time": "2026-08-05T09:27:55.32575572Z",
            "id": "IN-MAL-2026-014310",
            "modified_time": "2026-08-05T08:32:02Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc36"
            ],
            "import_time": "2026-08-05T13:08:33.247579077Z",
            "sha256": "d9e92f0e4d8bf5d9f5237d632b2c9c106705654fa0d463796a8e5b0accade86f",
            "id": "IN-MAL-2026-014644",
            "modified_time": "2026-08-05T12:24:41Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc37"
            ],
            "import_time": "2026-08-05T20:07:26.484975469Z",
            "sha256": "084aa59226b6f1c91e205d09ed3af1076691f739a14ff70485e6459ab295c9dd",
            "id": "IN-MAL-2026-015885",
            "modified_time": "2026-08-05T19:49:44Z",
            "source": "amazon-inspector"
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / sextant-cli-darwin-amd64

Package

Name: sextant-cli-darwin-amd64; View open source insights on deps.dev
Purl: pkg:npm/sextant-cli-darwin-amd64

Affected ranges

Affected versions

0.*

0.0.1-rc10

0.0.1-rc11

0.0.1-rc12

0.0.1-rc13

0.0.1-rc14

0.0.1-rc15

0.0.1-rc16

0.0.1-rc17

0.0.1-rc18

0.0.1-rc19

0.0.1-rc20

0.0.1-rc21

0.0.1-rc22

0.0.1-rc23

0.0.1-rc24

0.0.1-rc25

0.0.1-rc26

0.0.1-rc27

0.0.1-rc28

0.0.1-rc29

0.0.1-rc30

0.0.1-rc31

0.0.1-rc32

0.0.1-rc33

0.0.1-rc34

0.0.1-rc35

0.0.1-rc36

0.0.1-rc37

0.0.1-rc5

0.0.1-rc6

0.0.1-rc7

0.0.1-rc8

0.0.1-rc9

Database specific

indicators

{
    "package_integrity": [
        {
            "filename": "sextant-cli-darwin-amd64-0.0.1-rc34.tgz",
            "hashes": {
                "sha512_sri": "sha512-ev30GHEq/iLBTqp091ff6UJT7MNeAmNlug/1vKEKAiR+ru7GkvHsxJFCwKlIM/VPJbVcoAWgpLuB/Yszplw8kg==",
                "sha1": "0f6afad0da77412b11eda4d6ea43fae6ff681a79"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "dcd64b57eca945e9c4adc1358ab696237b317c494b2033d31b60f6243f73be0aab9750",
            "sha256": "c92a337b75dfd7f1f66f5d52628d89d994acd20193e368e722be39f5fcc40c3d",
            "path": "bin/sxt"
        },
        {
            "tlsh": "f7d0a765866461725ef84bd05d72900d62308d155806745d7bbb354c122e5b2a9f9228",
            "sha256": "24320f79a9c15b9705d5e9fe14f32345897cd64d744921349341a25287d4d45d",
            "path": "package.json"
        }
    ]
}

cwes

[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sextant-cli-darwin-amd64/MAL-2026-12028.json"