MAL-2026-12029

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sextant-cli-linux-amd64/MAL-2026-12029.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-12029

Published

2026-08-05T00:09:38Z

Modified

2026-08-06T13:34:45.514377088Z

Summary

Malicious code in sextant-cli-linux-amd64 (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (aab426dad8f1e5722f2836debe2f93730df98b7c109865426208edb687955b30)

sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay at wss://relay.sextant.top and exposes a local interactive shell to a remote controller. The binary uses creack/pty and exec.Command to spawn /bin/bash, /bin/sh, or /bin/zsh under a PTY and forwards stdio through WebRTC data channels, giving a remote party on the sextant.top relay a full interactive shell on the installer's host. The binary also contacts http://ip-api.com/json/ over cleartext HTTP to collect the host's public IP and geolocation and reports it back through the same control channel. Embedded strings referencing /etc/systemd and 'sextantsystemdbootoutdefault.claudekey' indicate a subcommand that installs the agent as a systemd unit for boot persistence. package.json's license URL points to https://github.com/ddos798/claudecontrol, and the binary internally references 'claudecontrol' and api.anthropic.com, consistent with a tool designed to remotely pilot the installer's host and Claude Code sessions. Regardless of the tool's advertised purpose, a network-sourced controller driving a PTY on the installer's machine, with systemd persistence support and host reconnaissance to a third-party geolocation service, constitutes a persistent remote backdoor into the installer host.

Database specific

{
    "malicious-packages-origins": [
        {
            "versions": [
                "0.0.1-rc34"
            ],
            "sha256": "56cebc1e798691d2dca22f19177333a2e8dba9e4e53c11f9d76de42a1a1c67cf",
            "import_time": "2026-08-05T00:44:43.315412896Z",
            "id": "IN-MAL-2026-011397",
            "modified_time": "2026-08-05T00:09:38Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc26"
            ],
            "sha256": "050c3a85c61d8fda2bf3555179d2049da12e6b7624d2d499093afdbc179b5a96",
            "import_time": "2026-08-05T01:39:31.594436982Z",
            "id": "IN-MAL-2026-011496",
            "modified_time": "2026-08-05T01:23:25Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc32"
            ],
            "sha256": "546e48fd8a2f238b4f5705420c8b74f2af2f7e8b67b9cd9f01159a01d6bd414f",
            "import_time": "2026-08-05T03:11:15.807717475Z",
            "id": "IN-MAL-2026-011511",
            "modified_time": "2026-08-05T01:41:12Z",
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "import_time": "2026-08-05T09:28:04.317305919Z",
            "sha256": "628ee990b20330de3a2b94bca68929113f4a77963ab0893209511616dce27b8e",
            "id": "IN-MAL-2026-014379",
            "modified_time": "2026-08-05T08:41:56Z",
            "versions": [
                "0.0.1-rc13"
            ]
        },
        {
            "versions": [
                "0.0.1-rc18"
            ],
            "sha256": "a2fa744ca1da8940b6de39da5a0fb0222e55772ff2ceb131ef5c7cf65904fd10",
            "import_time": "2026-08-05T09:28:04.190656765Z",
            "id": "IN-MAL-2026-014378",
            "modified_time": "2026-08-05T08:41:49Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc28"
            ],
            "sha256": "fdcb5b0d8d09d850fd57fb398de7fde24ecd0d982bdda498dc07ae684b6aefc6",
            "import_time": "2026-08-05T09:27:57.676190676Z",
            "id": "IN-MAL-2026-014330",
            "modified_time": "2026-08-05T08:35:02Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc21"
            ],
            "import_time": "2026-08-05T09:28:03.750912985Z",
            "sha256": "3234d5a1055f4a2d4f835c186fe69f973446beafb673a5e56050cbbcd67a3b11",
            "id": "IN-MAL-2026-014375",
            "modified_time": "2026-08-05T08:41:22Z",
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "import_time": "2026-08-05T09:28:04.509124749Z",
            "sha256": "362444e113c470f5fb6efc1af9ef59a3ff1e8bdcfc9b569c6b06b1bfbf7cde2e",
            "id": "IN-MAL-2026-014381",
            "modified_time": "2026-08-05T08:42:12Z",
            "versions": [
                "0.0.1-rc5"
            ]
        },
        {
            "source": "amazon-inspector",
            "import_time": "2026-08-05T09:28:03.424910259Z",
            "sha256": "b3d2ee4b5d82fc8a673206903bca6c72be413511ec968ac74b3902aaca5c3637",
            "id": "IN-MAL-2026-014372",
            "modified_time": "2026-08-05T08:40:57Z",
            "versions": [
                "0.0.1-rc30"
            ]
        },
        {
            "versions": [
                "0.0.1-rc35"
            ],
            "sha256": "e77a04e5d2060d173bc9b6b87efbc760daa5ba07ff55b9f2346258890effa8cd",
            "import_time": "2026-08-05T09:28:04.929497221Z",
            "id": "IN-MAL-2026-014385",
            "modified_time": "2026-08-05T08:42:43Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc7"
            ],
            "import_time": "2026-08-05T09:28:02.177835925Z",
            "sha256": "3411ae498b9f0953fd9211a1e775a488f7fad1b3a33e7cdcef2720a24a6784e5",
            "id": "IN-MAL-2026-014361",
            "modified_time": "2026-08-05T08:39:24Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc9"
            ],
            "import_time": "2026-08-05T09:27:53.098882114Z",
            "sha256": "93cdee3a41d3e26b2453278b34a41dadef9bf05b4680c0f9f1f062836c3b0227",
            "id": "IN-MAL-2026-014295",
            "modified_time": "2026-08-05T08:29:47Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc20"
            ],
            "sha256": "aa2c4f89953674713c128cbdaf55e061a95315de5e03c22b1bfbf1af87f8e9d8",
            "import_time": "2026-08-05T09:27:59.423026204Z",
            "id": "IN-MAL-2026-014344",
            "modified_time": "2026-08-05T08:37:01Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc24"
            ],
            "import_time": "2026-08-05T09:28:03.549131373Z",
            "sha256": "aef6e14c7cb82a5f0deb90014957ec05caaa6da04b2a6a7824d3149b2aa361bf",
            "id": "IN-MAL-2026-014373",
            "modified_time": "2026-08-05T08:41:04Z",
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "import_time": "2026-08-05T09:27:52.213382486Z",
            "sha256": "ef2c5b4e1a7b46248be73f0ae010359845d3f51ea19241e17625021d91c2ec9c",
            "id": "IN-MAL-2026-014288",
            "modified_time": "2026-08-05T08:28:42Z",
            "versions": [
                "0.0.1-rc29"
            ]
        },
        {
            "versions": [
                "0.0.1-rc15"
            ],
            "import_time": "2026-08-05T09:27:59.949900976Z",
            "sha256": "50ddc84aa24e2b41df216961ed92a6953b136d72461acbb2a114316849a3fe67",
            "id": "IN-MAL-2026-014349",
            "modified_time": "2026-08-05T08:37:47Z",
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "import_time": "2026-08-05T09:27:58.395365522Z",
            "sha256": "5836ffb718d0e4972f488124097994e72764198184dd0690e21ad0e3eefa1797",
            "id": "IN-MAL-2026-014335",
            "modified_time": "2026-08-05T08:35:46Z",
            "versions": [
                "0.0.1-rc27"
            ]
        },
        {
            "source": "amazon-inspector",
            "import_time": "2026-08-05T09:28:04.090225876Z",
            "sha256": "6b4a47d82e4ae6ba6e691f3e0bf9b8c7e309181cabf97da885502f4f0835e959",
            "id": "IN-MAL-2026-014377",
            "modified_time": "2026-08-05T08:41:39Z",
            "versions": [
                "0.0.1-rc19"
            ]
        },
        {
            "versions": [
                "0.0.1-rc14"
            ],
            "sha256": "96d8245de87819d034af12650855d5df22d028b54c54408450ad6a9f1a07f87e",
            "import_time": "2026-08-05T09:28:05.063946063Z",
            "id": "IN-MAL-2026-014386",
            "modified_time": "2026-08-05T08:42:52Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc33"
            ],
            "import_time": "2026-08-05T09:27:57.204910481Z",
            "sha256": "e288e053e8f8f6391eed39abd1e967c1a4a382fb4976574c962dc085d9881561",
            "id": "IN-MAL-2026-014327",
            "modified_time": "2026-08-05T08:34:31Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc12"
            ],
            "import_time": "2026-08-05T09:28:01.103063926Z",
            "sha256": "1175f4e0cdb7410fb13946451e1ff09da6057e056243d9606718a14ad39444fb",
            "id": "IN-MAL-2026-014355",
            "modified_time": "2026-08-05T08:38:36Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc6"
            ],
            "sha256": "3d28705c73cb1063bf806be02f901aa1b6a82b1a637eb8cf192f2fa97cf32840",
            "import_time": "2026-08-05T09:28:02.350629028Z",
            "id": "IN-MAL-2026-014363",
            "modified_time": "2026-08-05T08:39:42Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc16"
            ],
            "sha256": "4377c05245a4ddc82253aee80765ce2beb99fec159ee18b22713c1c12ac5e44a",
            "import_time": "2026-08-05T09:28:00.038664712Z",
            "id": "IN-MAL-2026-014350",
            "modified_time": "2026-08-05T08:37:56Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc37"
            ],
            "import_time": "2026-08-05T20:07:26.517902019Z",
            "sha256": "ff3296d588369230cf8184e621ef092ec0446a1c7bcda31a527bda5a6719fd6f",
            "id": "IN-MAL-2026-015886",
            "modified_time": "2026-08-05T19:49:57Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "0.0.1-rc36"
            ],
            "import_time": "2026-08-06T13:09:08.720547848Z",
            "sha256": "aab426dad8f1e5722f2836debe2f93730df98b7c109865426208edb687955b30",
            "id": "IN-MAL-2026-016268",
            "modified_time": "2026-08-06T12:56:15Z",
            "source": "amazon-inspector"
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / sextant-cli-linux-amd64

Package

Name: sextant-cli-linux-amd64; View open source insights on deps.dev
Purl: pkg:npm/sextant-cli-linux-amd64

Affected ranges

Affected versions

0.*

0.0.1-rc12

0.0.1-rc13

0.0.1-rc14

0.0.1-rc15

0.0.1-rc16

0.0.1-rc18

0.0.1-rc19

0.0.1-rc20

0.0.1-rc21

0.0.1-rc24

0.0.1-rc26

0.0.1-rc27

0.0.1-rc28

0.0.1-rc29

0.0.1-rc30

0.0.1-rc32

0.0.1-rc33

0.0.1-rc34

0.0.1-rc35

0.0.1-rc36

0.0.1-rc37

0.0.1-rc5

0.0.1-rc6

0.0.1-rc7

0.0.1-rc9

Database specific

indicators

{
    "package_integrity": [
        {
            "filename": "sextant-cli-linux-amd64-0.0.1-rc34.tgz",
            "hashes": {
                "sha512_sri": "sha512-31aFwv8WdnbGSJb7QC5JbTtXyGoJgWxAFkjVinm87RGGx1LvhNE6yBqyjzPSO41zWMbNfIVE/a27HLkf6+frkw==",
                "sha1": "cc99627252d1ed93dbe646fdfaaa4af818e90c46"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "bin/sxt",
            "sha256": "65f5217f1613bbbbe76ca5d1258d06654d6f85462da50ff6f9cac4434dc4e021",
            "tlsh": "3cd63807eca645e8c5aec130cab696237b717c494b3023e31b54b6397f76bd06ab9710"
        },
        {
            "path": "package.json",
            "sha256": "7e71ed096f336af61178da974b6796d82def7979cb95e145f62ec425544167b5",
            "tlsh": "c3d0a751843401735eec5fd41e21d00d66308da594067859ff7b2548022d67369ba6ac"
        }
    ]
}

cwes

[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sextant-cli-linux-amd64/MAL-2026-12029.json"