MAL-2026-12313

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ccfly/setup-darwin-x64/MAL-2026-12313.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12313
Published
2026-08-05T12:52:42Z
Modified
2026-08-06T14:34:45Z
Summary
Malicious code in @ccfly/setup-darwin-x64 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (409d11825a61bed068425296e83dcc0c87427579f7b5d724ec52e5e87465f2b5)

The package ships a prebuilt darwin/x64 Mach-O binary containing a Go agent (module github.com/ccfly/rescue) that, when executed, connects to a hardcoded remote broker at cc.hn / ccfly over WebSocket (ws://ccfly, wss://, https://cc.hn) using github.com/gorilla/websocket, spawns a pseudo-terminal via github.com/creack/pty, and pipes the WebSocket stream into that PTY. Symbols include agent.serve, agent.startPTY, agent.waitAuthorized, agent.wsBase and unixPTY.Read/Write/Resize/Close, giving the remote party interactive shell control of the host. A second stage (setup.downloadCcfly, setup.fetchAndExtract, setup.npmTarballURL, setup.extractFromTarGz, setup.runCcflyInstall, setup.redeemEnrollToken, setup.(*brokerClient).escalateToRescue, with a rodata reference to https://registry.npmjs.org) fetches and executes a further ccfly npm tarball after the broker approves an enrollment token — the additional code executed on the host is chosen by the remote broker, not the installer. The binary also inspects shell RC files and /etc/hosts (setup.scanShellProfilesForProxy, setup.checkProxyResidue, setup.checkHostsResidue, setup.runEnvChecks, setup.envReport) and POSTs an environment report back to the broker (setup.(*brokerClient).post; rodata latest.zshrc, export.ccfly).

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014797",
            "import_time": "2026-08-05T13:08:47.189036999Z",
            "modified_time": "2026-08-05T12:52:42Z",
            "sha256": "409d11825a61bed068425296e83dcc0c87427579f7b5d724ec52e5e87465f2b5",
            "source": "amazon-inspector",
            "versions": [
                "0.1.7"
            ]
        },
        {
            "id": "IN-MAL-2026-016519",
            "import_time": "2026-08-06T14:19:53.419509046Z",
            "modified_time": "2026-08-06T13:50:55Z",
            "sha256": "7d21b399d2a5d722eb93d370a7b54a0fec6ecc05069feaa486ff27c4f1b67d40",
            "source": "amazon-inspector",
            "versions": [
                "0.1.16"
            ]
        },
        {
            "id": "IN-MAL-2026-016522",
            "import_time": "2026-08-06T14:19:53.528820076Z",
            "modified_time": "2026-08-06T13:51:19Z",
            "sha256": "8e7e78a44b26b3fb9ef377c800143b3077591bc68fb213df369faa861db447dc",
            "source": "amazon-inspector",
            "versions": [
                "0.1.6"
            ]
        },
        {
            "id": "IN-MAL-2026-016520",
            "import_time": "2026-08-06T14:19:53.450152568Z",
            "modified_time": "2026-08-06T13:51:03Z",
            "sha256": "a1c39be148994a61b85ef299e0681be4621cdf125a9bade628776c7a65d144ff",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-016521",
            "import_time": "2026-08-06T14:19:53.494434323Z",
            "modified_time": "2026-08-06T13:51:10Z",
            "sha256": "f739222cb80305438dcdf3637dc6f07068b92bbd6ffc64a641dc651c50280359",
            "source": "amazon-inspector",
            "versions": [
                "0.1.14"
            ]
        },
        {
            "id": "IN-MAL-2026-016518",
            "import_time": "2026-08-06T14:19:53.368940243Z",
            "modified_time": "2026-08-06T13:50:47Z",
            "sha256": "2d55cbc45ac2afe713585d7ec0d1463c8de7c7ccb854e7c793a1af1df71f1639",
            "source": "amazon-inspector",
            "versions": [
                "0.1.1"
            ]
        },
        {
            "id": "IN-MAL-2026-016523",
            "import_time": "2026-08-06T14:19:53.570823163Z",
            "modified_time": "2026-08-06T13:51:29Z",
            "sha256": "8ffbb6d97a57594312533c9c836dd7a9f449c48313af350c1c8d7ab2d1a56cdb",
            "source": "amazon-inspector",
            "versions": [
                "0.1.9"
            ]
        },
        {
            "id": "IN-MAL-2026-016514",
            "import_time": "2026-08-06T14:19:53.160726747Z",
            "modified_time": "2026-08-06T13:50:16Z",
            "sha256": "fc3777096264b562b86f3662bc29f2c09d3759397092fde394a7ec8fd5c58e05",
            "source": "amazon-inspector",
            "versions": [
                "0.1.3"
            ]
        },
        {
            "id": "IN-MAL-2026-016516",
            "import_time": "2026-08-06T14:19:53.274234678Z",
            "modified_time": "2026-08-06T13:50:31Z",
            "sha256": "026b2da90a2fdf5903decd1bf5ec8329778b1c8d683ecdbb38cd17abc8e92df8",
            "source": "amazon-inspector",
            "versions": [
                "0.1.13"
            ]
        },
        {
            "id": "IN-MAL-2026-016515",
            "import_time": "2026-08-06T14:19:53.240941455Z",
            "modified_time": "2026-08-06T13:50:23Z",
            "sha256": "273db652a085f38fc059d78e57a2591e784edbe0d89059885fb104e86dd2cb0c",
            "source": "amazon-inspector",
            "versions": [
                "0.1.8"
            ]
        },
        {
            "id": "IN-MAL-2026-016517",
            "import_time": "2026-08-06T14:19:53.323963416Z",
            "modified_time": "2026-08-06T13:50:40Z",
            "sha256": "291482d6f72ebdb79abdbc258f737e01bafdae4ab79d0db2fb5116b44a6eab41",
            "source": "amazon-inspector",
            "versions": [
                "0.1.15"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @ccfly/setup-darwin-x64

Package

Name
@ccfly/setup-darwin-x64
View open source insights on deps.dev
Purl
pkg:npm/%40ccfly/setup-darwin-x64

Affected ranges

Affected versions

0.*
0.1.0
0.1.1
0.1.3
0.1.6
0.1.7
0.1.8
0.1.9
0.1.13
0.1.14
0.1.15
0.1.16

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "bin/ccfly-setup",
            "sha256": "689015ceb3abac6dd544c9ddcd3214a6d2eac9b60efd64847cf144c8c349f217",
            "tlsh": "97664a03eca515a5c0add135cab6a253bf71bc890b2123d32b90f6283f77bd069b9754"
        }
    ],
    "package_integrity": [
        {
            "filename": "setup-darwin-x64-0.1.7.tgz",
            "hashes": {
                "sha1": "84df9e51a5e100f9d41600dbb5cfd6f22b071bc5",
                "sha512_sri": "sha512-fzYVDkiLSGrZxsKfIXO+OMy12uOVfFZ7JZ+q9OkRvP7uQqe20IWqHhIKkT+xGxsjm4zgv846WWRw0373HEDFcg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ccfly/setup-darwin-x64/MAL-2026-12313.json"