MAL-2026-12028
Dashboard / Malicious Package / MAL-2026-12028
MAL-2026-12028
Summary: Malicious code in sextant-cli-darwin-amd64 (npm)
Details: Source: amazon-inspector (9d2e5ab6503eb2b9c12bf64e34cb2fe12227c07b179231ebe23f13b8866181f1) The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main, no bin mapping, and no scripts — the package is a platform-artifact shipped for consumption as an optionalDependency by a parent sextant-cli. Strings extracted from bin/sxt show it embeds github.com/coder/websocket and github.com/creack/pty together with the hardcoded relay URL wss://relay.sextant.top; that network-to-PTY dataflow is a remote-shell backdoor driven by an attacker-controlled WebSocket relay on the installer's host. The same binary contains the Anthropic API-key regex sk-ant-[a-z0-9]+-[A-Za-z0-9_-]{40,} alongside CLAUDE_CONFIG_DIR=, https://claude.ai/, and https://api.anthropic.com/v1/models, indicating the binary reads the installer's Claude configuration directory and fingerprints sk-ant-* credentials for exfiltration through the same relay. Additional strings embed http://ip-api.com/json/?fields=status,message,country,countryCode,city,timezone,isp,org,as,proxy,hosting,mobile,query, profiling the installer's public IP, city, ISP, org, ASN, and hosting/proxy flags. package.json declares its license as SEE LICENSE IN https://github.com/ddos798/claude_control, and the binary references https://claude.ai/install.sh and https://registry.npmjs.org/sextant-cli/latest for self-update. Delivering behavior only as a stripped compiled binary conceals the network-to-PTY, credential-regex, and geolocation logic from JS-level inspection.
References: https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc34, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc31, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc10, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc16, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc11, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc12, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc26, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc6, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc24, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc22, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc14, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc23, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc19, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc35, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc18, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc20, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc27, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc21, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc25, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc13, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc28, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc7, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc29, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc30, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc17, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc8, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc33, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc9, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc32, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc5, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc15, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc36, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc37, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc39, https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc38
Affected packages
Package
Name: sextant-cli-darwin-amd64
Purl: pkg:npm/sextant-cli-darwin-amd64
Affected ranges
Type: N/A
Events:
