MAL-2026-13418

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ccfly/setup-linux-x64/MAL-2026-13418.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-13418

Published

2026-08-06T13:51:43Z

Modified

2026-08-06T14:34:46.549511900Z

Summary

Malicious code in @ccfly/setup-linux-x64 (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (33138ee17148f975a7c0b34f5d6ee1a4ad082395b87872dc91de0778130b91c8)

The tarball ships a single 6.9 MB linux/x64 Go executable at bin/ccfly-setup and no source. The binary links github.com/creack/pty (PTY spawning) and github.com/gorilla/websocket (WebSocket client), and contains hardcoded destinations ws://ccflycc.hn, wss://, and https://cc.hn along with strings that drive apt-get/pacman/zypper package installs after a remote 'approve' step (including a Chinese status string meaning 'client installed and paired'). This is a remote-controlled shell/executor architecture: a persistent WebSocket to a vendor-controlled server plus a local PTY and privileged package-manager invocations give whoever controls ccflycc.hn / cc.hn full command execution and privileged package installation on the host running the binary. package.json declares only {os:[linux], cpu:[x64], files:[bin]} with no scripts, main, or bin field, so npm install does not by itself execute the binary; the backdoor activates when the companion @ccfly/* wrapper CLI resolves this optionalDependency and invokes bin/ccfly-setup. The delivery uses plain ws:// in addition to wss://, and no source is shipped for independent audit.

Database specific

{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-06T13:52:11Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016528",
            "import_time": "2026-08-06T14:19:53.804217599Z",
            "sha256": "296e1b146603b0e56bada239257839e6c404720a263d3cf467a727397870f022",
            "versions": [
                "0.1.4"
            ]
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T13:52:24Z",
            "sha256": "33138ee17148f975a7c0b34f5d6ee1a4ad082395b87872dc91de0778130b91c8",
            "import_time": "2026-08-06T14:19:53.837368657Z",
            "id": "IN-MAL-2026-016529",
            "versions": [
                "0.1.3"
            ]
        },
        {
            "modified_time": "2026-08-06T13:51:51Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016526",
            "import_time": "2026-08-06T14:19:53.715108564Z",
            "sha256": "5431775fbfb5393064dfa86e71467919e31bc482ca063b7becb39314dba4ff9f",
            "versions": [
                "0.1.9"
            ]
        },
        {
            "modified_time": "2026-08-06T13:51:43Z",
            "source": "amazon-inspector",
            "sha256": "b4d7aa40a791ac6747d32cf63e15018433ac384c673c2587d6d7aa1db2889819",
            "import_time": "2026-08-06T14:19:53.658722047Z",
            "id": "IN-MAL-2026-016525",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "modified_time": "2026-08-06T13:52:52Z",
            "source": "amazon-inspector",
            "sha256": "ccb15b24f68c411ed5952e93adfb149b226298e8812b32a3293308878d87240c",
            "import_time": "2026-08-06T14:19:54.026111431Z",
            "id": "IN-MAL-2026-016532",
            "versions": [
                "0.1.1"
            ]
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T13:53:01Z",
            "sha256": "cf67bf381e483cbe273650f4d3af480e113639709c85c6360e7d06388a7b3143",
            "import_time": "2026-08-06T14:19:54.063680206Z",
            "id": "IN-MAL-2026-016533",
            "versions": [
                "0.1.10"
            ]
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T13:53:11Z",
            "sha256": "5208fc1432f95ef04a90f0cda3cd92b45196ba8e3358ce0ec36b249ef5b95a01",
            "import_time": "2026-08-06T14:19:54.104307434Z",
            "id": "IN-MAL-2026-016534",
            "versions": [
                "0.1.17"
            ]
        },
        {
            "modified_time": "2026-08-06T13:52:45Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016531",
            "import_time": "2026-08-06T14:19:53.964501895Z",
            "sha256": "82bc092752f32a5ed0564c69bce8ef621d63ab9b89d5a1b74a00710d66bb4ada",
            "versions": [
                "0.1.19"
            ]
        },
        {
            "modified_time": "2026-08-06T13:51:59Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016527",
            "import_time": "2026-08-06T14:19:53.749459592Z",
            "sha256": "9632eb35be0c9ea25d90fa7dc0fe9ecd4eaa3b44b0fba5616cb399429d032315",
            "versions": [
                "0.1.14"
            ]
        },
        {
            "modified_time": "2026-08-06T13:52:37Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016530",
            "import_time": "2026-08-06T14:19:53.876140322Z",
            "sha256": "c5b8ba92b0192289b9bd7316dcf6fd8964a52fbbbcf50845208501181917800a",
            "versions": [
                "0.1.2"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / @ccfly/setup-linux-x64

Package

Name: @ccfly/setup-linux-x64; View open source insights on deps.dev
Purl: pkg:npm/%40ccfly/setup-linux-x64

Affected ranges

Affected versions

0.*

0.1.0

0.1.1

0.1.2

0.1.3

0.1.4

0.1.9

0.1.10

0.1.14

0.1.17

0.1.19

Database specific

indicators

{
    "package_integrity": [
        {
            "filename": "setup-linux-x64-0.1.4.tgz",
            "hashes": {
                "sha512_sri": "sha512-01v35tGwt/OWOUAsbgha2mAIA1hGdinx8P1mKo3z0QRkG9rBRd7vNg0u3QzSY+BZF/Bs8p46njBSdPd6Hrrm1g==",
                "sha1": "c28f6659398e2b0fb13c219319aacb257cb3ca4d"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "8a664917fca525e9c0ae913189639513bf727c494b3123d35f90ba283f76bd0aab9740",
            "sha256": "fa5f9e252b4b2ca17fe3db33e92b8d96585c86eff4bf6be281fec71077b7b867",
            "path": "bin/ccfly-setup"
        },
        {
            "tlsh": "d8d02b214919813316d8eb905c21434d6d100d920190748c8ebf210c512c76159f6af9",
            "sha256": "159efe1f2a326113006d6e651bf4185ba825fb3753a12e8a281107779db9a126",
            "path": "package.json"
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ccfly/setup-linux-x64/MAL-2026-13418.json"

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]