MAL-2026-12043
Dashboard / Malicious Package / MAL-2026-12043
MAL-2026-12043
Summary: Malicious code in sextant-cli-linux-arm64 (npm)
Details: Source: amazon-inspector (fc34f69b5a68c549feccfb32cc2dbfbf2d4c787a4876241027b4299305fd2c53) The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt. The package.json omits repository, author, main, bin, files, and scripts fields, and its license field points at github.com/ddos798/claude_control — a self-labeled 'claude_control' project. Strings in bin/sxt reveal a full WebRTC stack (pion/webrtc/v4, pion/turn/v5, pion/ice/v4, coder/websocket, go-qrcode) plus a hardcoded signaling/relay endpoint https://relay.sextant.top/install, giving the binary the shape of a remote-control agent that pairs the installer's host to an author-controlled peer over WebRTC data channels. Adjacent strings 'sk-ant-', 'CLAUDE_CONFIG_DIR', 'https://api.anthropic.com/v1/models', 'https://claude.ai/install.sh', and '@google/gemini-cli' show the binary is positioned to read Anthropic API keys and Claude Code / Gemini CLI configuration from the installer and hand them to the remote peer through the established channel. An additional string http://ip-api.com/json/ provides public-IP geolocation of the host for the remote operator. The combination of an opaque metadata-only npm manifest, a bundled native binary embedding a full peer-to-peer control stack, a hardcoded author relay, and embedded references to developer AI-credential material is a backdoor with credential-theft capability against the installer.
References: https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc12, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc11, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc25, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc29, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc19, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc20, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc32, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc18, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc16, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc10, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc8, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc17, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc26, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc21, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc30, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc15, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc14, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc24, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc33, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc13, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc22, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc23, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc7, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc5, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc28, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc35, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc31, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc36, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc38, https://www.npmjs.com/package/sextant-cli-linux-arm64/v/0.0.1-rc39
Affected packages
Package
Name: sextant-cli-linux-arm64
Purl: pkg:npm/sextant-cli-linux-arm64
Affected ranges
Type: N/A
Events:
