MAL-2026-12029
Dashboard / Malicious Package / MAL-2026-12029
MAL-2026-12029
Summary: Malicious code in sextant-cli-linux-amd64 (npm)
Details: Source: amazon-inspector (aab426dad8f1e5722f2836debe2f93730df98b7c109865426208edb687955b30) sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay at wss://relay.sextant.top and exposes a local interactive shell to a remote controller. The binary uses creack/pty and exec.Command to spawn /bin/bash, /bin/sh, or /bin/zsh under a PTY and forwards stdio through WebRTC data channels, giving a remote party on the sextant.top relay a full interactive shell on the installer's host. The binary also contacts http://ip-api.com/json/ over cleartext HTTP to collect the host's public IP and geolocation and reports it back through the same control channel. Embedded strings referencing /etc/systemd and 'sextantsystemdbootoutdefault.claudekey' indicate a subcommand that installs the agent as a systemd unit for boot persistence. package.json's license URL points to https://github.com/ddos798/claude_control, and the binary internally references 'claude_control' and api.anthropic.com, consistent with a tool designed to remotely pilot the installer's host and Claude Code sessions. Regardless of the tool's advertised purpose, a network-sourced controller driving a PTY on the installer's machine, with systemd persistence support and host reconnaissance to a third-party geolocation service, constitutes a persistent remote backdoor into the installer host.
References: https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc34, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc26, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc32, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc13, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc18, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc28, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc21, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc5, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc30, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc35, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc7, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc9, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc20, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc24, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc29, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc15, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc27, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc19, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc14, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc33, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc12, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc6, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc16, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc37, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc36, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc38, https://www.npmjs.com/package/sextant-cli-linux-amd64/v/0.0.1-rc39
Affected packages
Package
Name: sextant-cli-linux-amd64
Purl: pkg:npm/sextant-cli-linux-amd64
Affected ranges
Type: N/A
Events:
