MAL-2026-13418

Dashboard / Malicious Package / MAL-2026-13418

MAL-2026-13418

Summary: Malicious code in @ccfly/setup-linux-x64 (npm)

Details: Source: amazon-inspector (33138ee17148f975a7c0b34f5d6ee1a4ad082395b87872dc91de0778130b91c8) The tarball ships a single 6.9 MB linux/x64 Go executable at bin/ccfly-setup and no source. The binary links github.com/creack/pty (PTY spawning) and github.com/gorilla/websocket (WebSocket client), and contains hardcoded destinations ws://ccflycc.hn, wss://, and https://cc.hn along with strings that drive apt-get/pacman/zypper package installs after a remote 'approve' step (including a Chinese status string meaning 'client installed and paired'). This is a remote-controlled shell/executor architecture: a persistent WebSocket to a vendor-controlled server plus a local PTY and privileged package-manager invocations give whoever controls ccflycc.hn / cc.hn full command execution and privileged package installation on the host running the binary. package.json declares only {os:[linux], cpu:[x64], files:[bin]} with no scripts, main, or bin field, so `npm install` does not by itself execute the binary; the backdoor activates when the companion @ccfly/* wrapper CLI resolves this optionalDependency and invokes bin/ccfly-setup. The delivery uses plain ws:// in addition to wss://, and no source is shipped for independent audit.

References: https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.4, https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.3, https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.9, https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.0, https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.1, https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.10, https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.17, https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.19, https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.14, https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.2