MAL-2026-12043

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sextant-cli-linux-arm64/MAL-2026-12043.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-12043

Published

2026-08-05T00:57:42Z

Modified

2026-08-05T16:51:08.374060598Z

Summary

Malicious code in sextant-cli-linux-arm64 (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (fc34f69b5a68c549feccfb32cc2dbfbf2d4c787a4876241027b4299305fd2c53)

The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt. The package.json omits repository, author, main, bin, files, and scripts fields, and its license field points at github.com/ddos798/claudecontrol — a self-labeled 'claudecontrol' project. Strings in bin/sxt reveal a full WebRTC stack (pion/webrtc/v4, pion/turn/v5, pion/ice/v4, coder/websocket, go-qrcode) plus a hardcoded signaling/relay endpoint https://relay.sextant.top/install, giving the binary the shape of a remote-control agent that pairs the installer's host to an author-controlled peer over WebRTC data channels. Adjacent strings 'sk-ant-', 'CLAUDECONFIGDIR', 'https://api.anthropic.com/v1/models', 'https://claude.ai/install.sh', and '@google/gemini-cli' show the binary is positioned to read Anthropic API keys and Claude Code / Gemini CLI configuration from the installer and hand them to the remote peer through the established channel. An additional string http://ip-api.com/json/ provides public-IP geolocation of the host for the remote operator. The combination of an opaque metadata-only npm manifest, a bundled native binary embedding a full peer-to-peer control stack, a hardcoded author relay, and embedded references to developer AI-credential material is a backdoor with credential-theft capability against the installer.

Database specific

{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T01:39:31.069707504Z",
            "modified_time": "2026-08-05T01:04:47Z",
            "id": "IN-MAL-2026-011485",
            "sha256": "418037e9b31b644112b260f94ff33361fb14089cfa986a2e1b3b790f5e1efa9c",
            "versions": [
                "0.0.1-rc12"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T01:39:31.115046478Z",
            "modified_time": "2026-08-05T01:05:17Z",
            "id": "IN-MAL-2026-011486",
            "sha256": "5154aac3c250efe54db62ca5d643d257041199d7abb72fe061db7d4e472d02b1",
            "versions": [
                "0.0.1-rc11"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T01:39:30.888093054Z",
            "modified_time": "2026-08-05T01:02:30Z",
            "id": "IN-MAL-2026-011481",
            "sha256": "cb7ff319c462df37238c84a4d224ed57bb0020dba780f8b41b44705e479744b1",
            "versions": [
                "0.0.1-rc25"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T01:39:30.610014783Z",
            "modified_time": "2026-08-05T00:57:42Z",
            "id": "IN-MAL-2026-011474",
            "sha256": "4625bc910b50e9ab5ce1584e968f36b48ac0a3cee072c0bfb3bee9602e33a8ab",
            "versions": [
                "0.0.1-rc29"
            ],
            "source": "amazon-inspector"
        },
        {
            "modified_time": "2026-08-05T08:37:16Z",
            "import_time": "2026-08-05T09:27:59.631721312Z",
            "id": "IN-MAL-2026-014346",
            "sha256": "40aae1ad3e070677d2994912ce2b716755f44d1624ec5783dcdfed76ddc99a01",
            "versions": [
                "0.0.1-rc19"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:27:59.325349718Z",
            "modified_time": "2026-08-05T08:36:52Z",
            "id": "IN-MAL-2026-014343",
            "sha256": "6bceee78c4f7d7d00f951f62ce70f492ca326062c5322db0cc1d4fa764425d99",
            "versions": [
                "0.0.1-rc20"
            ],
            "source": "amazon-inspector"
        },
        {
            "modified_time": "2026-08-05T08:40:22Z",
            "import_time": "2026-08-05T09:28:02.879845766Z",
            "id": "IN-MAL-2026-014368",
            "sha256": "794a709a94cfcad6d856d1a0f61c22b0bf87a82bfed35fc316317b5bc241706a",
            "versions": [
                "0.0.1-rc32"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:27:59.8444492Z",
            "modified_time": "2026-08-05T08:37:39Z",
            "id": "IN-MAL-2026-014348",
            "sha256": "80741f7308bb0a773ba5d253d5758418b281c6f52bd76f3539d543af90965182",
            "versions": [
                "0.0.1-rc18"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:28:03.083260422Z",
            "modified_time": "2026-08-05T08:40:42Z",
            "id": "IN-MAL-2026-014370",
            "sha256": "9091ae60e8aa113b83f3f75134a174dcab691574dd0377f1c4243b4707fc1b54",
            "versions": [
                "0.0.1-rc16"
            ],
            "source": "amazon-inspector"
        },
        {
            "modified_time": "2026-08-05T08:42:05Z",
            "import_time": "2026-08-05T09:28:04.414309184Z",
            "id": "IN-MAL-2026-014380",
            "sha256": "f769878c746b1fe9596d5de053cdc5d1e0a5b66cd4207095a3e82a6d0d01caee",
            "versions": [
                "0.0.1-rc10"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:28:01.979094816Z",
            "modified_time": "2026-08-05T08:39:09Z",
            "id": "IN-MAL-2026-014359",
            "sha256": "02b65da196043b5f6fa34edb6cc2493d481f58f07af53c82ded5579bc119beae",
            "versions": [
                "0.0.1-rc8"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:28:04.801848774Z",
            "modified_time": "2026-08-05T08:42:35Z",
            "id": "IN-MAL-2026-014384",
            "sha256": "24e50a2ebf918c72248b1466d84553c98be7f02f5b5eeb1542492a62d1dc43cf",
            "versions": [
                "0.0.1-rc17"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:27:58.712924869Z",
            "modified_time": "2026-08-05T08:36:02Z",
            "id": "IN-MAL-2026-014337",
            "sha256": "65bdb3b695578f85c0960efee3ed4905d494c84a3ee531621ee1ffacc626a5e0",
            "versions": [
                "0.0.1-rc26"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:28:03.862266307Z",
            "modified_time": "2026-08-05T08:41:31Z",
            "id": "IN-MAL-2026-014376",
            "sha256": "a68cb00b38e32b20b6b3dd1e8924bda83aed0b0ab7fb818cc7def59fe46e1b03",
            "versions": [
                "0.0.1-rc21"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:27:57.303253238Z",
            "modified_time": "2026-08-05T08:34:41Z",
            "id": "IN-MAL-2026-014328",
            "sha256": "b913310a2ee8bccdb21b116744f384fb0c7eee3cab368bd850b6934715704708",
            "versions": [
                "0.0.1-rc30"
            ],
            "source": "amazon-inspector"
        },
        {
            "modified_time": "2026-08-05T08:38:13Z",
            "import_time": "2026-08-05T09:28:00.364278951Z",
            "id": "IN-MAL-2026-014352",
            "sha256": "fc34f69b5a68c549feccfb32cc2dbfbf2d4c787a4876241027b4299305fd2c53",
            "versions": [
                "0.0.1-rc15"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:28:00.958997412Z",
            "modified_time": "2026-08-05T08:38:29Z",
            "id": "IN-MAL-2026-014354",
            "sha256": "0b912d4062490cae96d4eb8d1b6fe79fbcc753d63d1ce687c2b365c968042bd9",
            "versions": [
                "0.0.1-rc14"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:27:58.976957083Z",
            "modified_time": "2026-08-05T08:36:27Z",
            "id": "IN-MAL-2026-014340",
            "sha256": "1d37d85890962b7e7964808b7f350f10580bd199a84ac7bf70a94190f7bdba39",
            "versions": [
                "0.0.1-rc24"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:27:57.020263056Z",
            "modified_time": "2026-08-05T08:34:14Z",
            "id": "IN-MAL-2026-014325",
            "sha256": "4d76f3e22b3e21346682943b7ae07255765af6464f47b398958ed010de1887cb",
            "versions": [
                "0.0.1-rc33"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:28:00.623794766Z",
            "modified_time": "2026-08-05T08:38:20Z",
            "id": "IN-MAL-2026-014353",
            "sha256": "663e9bff9653a348f5b6bd01b9a914442335cb8f29d886257508d02e2809faa3",
            "versions": [
                "0.0.1-rc13"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:28:04.71125622Z",
            "modified_time": "2026-08-05T08:42:28Z",
            "id": "IN-MAL-2026-014383",
            "sha256": "8c822da26354b84c353e24370847616465100024645ecea2428dcd9c9508bd9c",
            "versions": [
                "0.0.1-rc22"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:27:58.800161709Z",
            "modified_time": "2026-08-05T08:36:11Z",
            "id": "IN-MAL-2026-014338",
            "sha256": "be89ba2dff50dd7f82f3f253c093f206b938047963f3b3d632c3481cd0af2ee8",
            "versions": [
                "0.0.1-rc23"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:28:01.860046852Z",
            "modified_time": "2026-08-05T08:39:02Z",
            "id": "IN-MAL-2026-014358",
            "sha256": "f691736954a0be654ddb160f464ea1532b0ce07b6153c663303324a5f1062244",
            "versions": [
                "0.0.1-rc7"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:28:02.556271337Z",
            "modified_time": "2026-08-05T08:40:00Z",
            "id": "IN-MAL-2026-014365",
            "sha256": "2a1160b86f511d06fffa7aefc8eada7a25d76c10d2d403a0ce5535f94e9133ca",
            "versions": [
                "0.0.1-rc5"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:28:04.625148534Z",
            "modified_time": "2026-08-05T08:42:21Z",
            "id": "IN-MAL-2026-014382",
            "sha256": "6e06cc13a704d66a247c91063fdcb5d7f0f4024371ac8e3ca2e69f5767ab024c",
            "versions": [
                "0.0.1-rc28"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:27:57.108741829Z",
            "modified_time": "2026-08-05T08:34:22Z",
            "id": "IN-MAL-2026-014326",
            "sha256": "7db22c238993ce482f2695a826b8de1b1184f9737599621f29155fd290ef745c",
            "versions": [
                "0.0.1-rc35"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T09:28:03.226185948Z",
            "modified_time": "2026-08-05T08:40:50Z",
            "id": "IN-MAL-2026-014371",
            "sha256": "85ca631bc3fb1aa563a2e2e6a73e06346e7f056bafef77c072006e2f3ef6a204",
            "versions": [
                "0.0.1-rc31"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T16:13:49.801122369Z",
            "modified_time": "2026-08-05T16:10:12Z",
            "id": "IN-MAL-2026-015822",
            "sha256": "d2d8dc2926c4bab62527ab1d2875d0b421eb0e21fcd5d44246db63fbcbd50460",
            "versions": [
                "0.0.1-rc36"
            ],
            "source": "amazon-inspector"
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / sextant-cli-linux-arm64

Package

Name: sextant-cli-linux-arm64; View open source insights on deps.dev
Purl: pkg:npm/sextant-cli-linux-arm64

Affected ranges

Affected versions

0.*

0.0.1-rc10

0.0.1-rc11

0.0.1-rc12

0.0.1-rc13

0.0.1-rc14

0.0.1-rc15

0.0.1-rc16

0.0.1-rc17

0.0.1-rc18

0.0.1-rc19

0.0.1-rc20

0.0.1-rc21

0.0.1-rc22

0.0.1-rc23

0.0.1-rc24

0.0.1-rc25

0.0.1-rc26

0.0.1-rc28

0.0.1-rc29

0.0.1-rc30

0.0.1-rc31

0.0.1-rc32

0.0.1-rc33

0.0.1-rc35

0.0.1-rc36

0.0.1-rc5

0.0.1-rc7

0.0.1-rc8

Database specific

cwes

[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sextant-cli-linux-arm64/MAL-2026-12043.json"

indicators

{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-YRQa1Azp76d6Al9PgLBPRAoNtKVBqmDuS6zCVVocObFwJ7q6Fx3CuKpLgIMCnsROLBYBqtMOUTKLlhAi+Ua6rw==",
                "sha1": "57e7fe935798ca4c899f6334f255ee9d28b200d5"
            },
            "filename": "sextant-cli-linux-arm64-0.0.1-rc12.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "bin/sxt",
            "sha256": "bb6643f21fe469f3aecbcd764906f3473121994a45d2577088cd42309cf2389d",
            "tlsh": "ebc66c55bc1db5a2daca75306b661394b238bc084b92c7176718bb3df9f2784cf132a1"
        },
        {
            "path": "package.json",
            "tlsh": "2ed0a751042401b319e857e45e21f00daa308de994457808af6b764d022d5726bb76a9",
            "sha256": "2234fb1f2b224646e07d0115380f3f35ff66c69215d51404962270b8616a4919"
        }
    ]
}