MAL-2026-13417

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ccfly/setup-linux-arm64/MAL-2026-13417.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13417
Published
2026-08-06T13:51:36Z
Modified
2026-08-06T14:34:45.802873990Z
Summary
Malicious code in @ccfly/setup-linux-arm64 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (faefd7405c377b2260ca4d731c9234a294d8d07b559646b8fc58be5488906eec)

The package ships a 6.3 MB linux/arm64 Go binary at bin/ccfly-setup. The binary embeds github.com/creack/pty (PTY spawner) and github.com/gorilla/websocket alongside internal packages github.com/ccfly/rescue/internal/{agent,setup,proto}, and contains hardcoded remote endpoints ws://ccflycc.hn, wss://…, https://cc.hn, and latest.ccfly, together with strings such as 'approveccfly-install' and '客户端已安装并配对' ('client installed and paired'). The binary dials the hardcoded ccfly server over WebSocket and bridges the connection to a locally spawned PTY, giving the remote endpoint an interactive shell on the host that runs it — a persistent remote-access channel controlled by whoever operates ccfly.hn. package.json declares os:linux, cpu:arm64, files:['bin'], and no scripts or bin map, so this sub-package alone is not auto-executed on npm install; it is a platform-optional payload intended to be resolved as an optionalDependency of a parent @ccfly/ wrapper, which then invokes bin/ccfly-setup and activates the remote-PTY channel on the installer's machine.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-06T13:51:36Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016524",
            "import_time": "2026-08-06T14:19:53.619982226Z",
            "sha256": "faefd7405c377b2260ca4d731c9234a294d8d07b559646b8fc58be5488906eec",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @ccfly/setup-linux-arm64

Package

Name
@ccfly/setup-linux-arm64
View open source insights on deps.dev
Purl
pkg:npm/%40ccfly/setup-linux-arm64

Affected ranges

Affected versions

0.*
0.1.0

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "setup-linux-arm64-0.1.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-fO1Bqckd7/eZ/bR23N72X2F0+08N5800xaVh8PKs6GNaKES28IAPSOxGNpQkHWWcmS5zD9u0VXDJ22HLiaNqWg==",
                "sha1": "506665480ae5e47ec1494192b624be31c50e3b32"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "bf566b5abc1e3562d6c976352f6212957238bc4c5f82c7136a18bb3cbef27588f13261",
            "sha256": "ea8bc508e37f5894b1e5405cd286b0e178cdbbbd0d6595ef2e76a2c3d91a5da8",
            "path": "bin/ccfly-setup"
        },
        {
            "tlsh": "a3d02b104a0a403314d8e7e05d25638dad100dd70190b48886afb10d511c7611bf69f9",
            "sha256": "bdb35694b03222a2dbd278edbede80ec5e8ec2d6345090eee462170607a02cb6",
            "path": "package.json"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ccfly/setup-linux-arm64/MAL-2026-13417.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]