sextant-cli-darwin-arm64

{"schema_version":"1.7.4","id":"MAL-2026-11997","published":"2026-08-05T00:00:26Z","modified":"2026-08-07T12:53:22.646421148Z","summary":"Malicious code in sextant-cli-darwin-arm64 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (23978b08a7e3f8af97d2c8060e7fc3aca9a18d9f3435163a9d3ab97ac0b9d4d0)\nPackage ships a darwin/arm64 Go binary that opens an outbound WebSocket to a hardcoded author-controlled relay at wss://relay.sextant.top and links a PTY library (github.com/creack/pty) with a WebSocket client (github.com/coder/websocket), implementing the network-driven pseudo-terminal remote-shell pattern that yields full-host code execution to the operator of that relay. The binary additionally binds listeners on 0.0.0.0:7280, 0.0.0.0:7281, and 0.0.0.0:9000 (a 'ws://%s:%s%s' format string is present), exposing the PTY/WebSocket surface to the local network rather than loopback. Embedded strings include a regex specifically matching Anthropic API keys ('sk-ant-[a-z0-9]+-[A-Za-z0-9_-]{40,}') and references to CLAUDE_CONFIG_DIR and ~/.claude paths, allowing extraction of the installer's Anthropic credentials, which are then reachable via the same relay channel. A separate POST to https://relay.sextant.top/install combined with a call to http://ip-api.com/json/?fields=status,message,country,countryCode,city,timezone,query reports installer geolocation and host identity to the author. The npm-facing metadata describes the package only as 'Sextant (sxt) binary for darwin/arm64', while the license field points to a GitHub repository named 'claude_control' — the shipped functionality (remote control of Claude Code / Gemini CLI sessions plus API-key exfiltration) is not disclosed in the package description or README.\n","affected":[{"package":{"name":"sextant-cli-darwin-arm64","ecosystem":"npm"},"versions":["0.0.1-rc24","0.0.1-rc31","0.0.1-rc14","0.0.1-rc19","0.0.1-rc23","0.0.1-rc25","0.0.1-rc35","0.0.1-rc17","0.0.1-rc16","0.0.1-rc21","0.0.1-rc15","0.0.1-rc20","0.0.1-rc28","0.0.1-rc13","0.0.1-rc6","0.0.1-rc34","0.0.1-rc27","0.0.1-rc33","0.0.1-rc5","0.0.1-rc9","0.0.1-rc29","0.0.1-rc12","0.0.1-rc8","0.0.1-rc30","0.0.1-rc32","0.0.1-rc22","0.0.1-rc26","0.0.1-rc7","0.0.1-rc11","0.0.1-rc10","0.0.1-rc37","0.0.1-rc36","0.0.1-rc39","0.0.1-rc38"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"bin/sxt","sha256":"9120db82450629ee5220196d7b15d035f99aeb05225a62e1136086efaaee5d24","tlsh":"7bc67c45bc1d6562cac9b6316f7653947338bc448b81c7271628bb3dbef27858f232a1"},{"path":"package.json","sha256":"52c09e519516de27a66a384d20fafd91ae5fd37467612a8b2066ed97133071a0","tlsh":"d7d0a750466461b31de857e08d72b00da3304c991c46744c2f6b754c126e4a29bf6224"}],"package_integrity":[{"filename":"sextant-cli-darwin-arm64-0.0.1-rc24.tgz","hashes":{"sha1":"08ab181aebc8bba297cf84127aa38dc09c300dd5","sha512_sri":"sha512-qHQr/YA0NQL/MdPxIeoCrU57aWVlcsUIm5zgDG+jQNkHHGYe4QVuTTUw5sf44p+pcSw+RFfBYAfcRJKCPHZVYg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc24"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc31"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc14"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc19"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc23"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc25"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc35"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc17"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc16"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc21"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc15"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc20"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc28"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc13"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc34"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc27"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc33"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc9"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc29"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc12"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc8"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc30"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc32"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc22"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc26"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc11"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc10"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc37"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc36"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc39"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-arm64/v/0.0.1-rc38"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-011364","import_time":"2026-08-05T00:04:39.161614209Z","modified_time":"2026-08-05T00:00:26Z","sha256":"395a381c321ebe4cfb276cf354d97d45a8fde8f9882b2d31471a7d6ac5e74229","source":"amazon-inspector","versions":["0.0.1-rc24"]},{"id":"IN-MAL-2026-014329","import_time":"2026-08-05T09:27:57.49506179Z","modified_time":"2026-08-05T08:34:51Z","sha256":"fe24e808955cc8fd67f5c49e25eb24e793a7638822d4ad9f949df84ec84f3537","source":"amazon-inspector","versions":["0.0.1-rc31"]},{"id":"IN-MAL-2026-014351","import_time":"2026-08-05T09:28:00.144332153Z","modified_time":"2026-08-05T08:38:03Z","sha256":"7cc2139b9e4cf2fd1d80734e23a313d5c61619b1f59c5507dd8a43f7974fb9eb","source":"amazon-inspector","versions":["0.0.1-rc14"]},{"id":"IN-MAL-2026-014345","import_time":"2026-08-05T09:27:59.509200154Z","modified_time":"2026-08-05T08:37:08Z","sha256":"a1efc69e5b83ae30eeac5281e41f7d1b47ef27d8554ceea4cd7c4ed2eb327e05","source":"amazon-inspector","versions":["0.0.1-rc19"]},{"id":"IN-MAL-2026-014339","import_time":"2026-08-05T09:27:58.892636071Z","modified_time":"2026-08-05T08:36:18Z","sha256":"d278b0e3fdda4a2c0d2e31d568f22c433ff5eca932b0c898c157c560c7ed94fe","source":"amazon-inspector","versions":["0.0.1-rc23"]},{"id":"IN-MAL-2026-014317","import_time":"2026-08-05T09:27:56.128259373Z","modified_time":"2026-08-05T08:33:04Z","sha256":"d558a19027d65b843f291d6a75281072acdd80bbbb7fa0e4b406e35e7232071a","source":"amazon-inspector","versions":["0.0.1-rc25"]},{"id":"IN-MAL-2026-014298","import_time":"2026-08-05T09:27:53.528623118Z","modified_time":"2026-08-05T08:30:12Z","sha256":"0b9b792dd92c4c7527463c7b8a8b634d042e236b10a228e920d6a45120906d2b","source":"amazon-inspector","versions":["0.0.1-rc35"]},{"id":"IN-MAL-2026-014347","import_time":"2026-08-05T09:27:59.743812417Z","modified_time":"2026-08-05T08:37:28Z","sha256":"3b0e9f87f2dbf8fab835b00e3a5331455d95e9ce534165edef5a384c297bbd43","source":"amazon-inspector","versions":["0.0.1-rc17"]},{"id":"IN-MAL-2026-014308","import_time":"2026-08-05T09:27:55.082460923Z","modified_time":"2026-08-05T08:31:48Z","sha256":"5d91d56d74ad284c31e231c17e7ca081186a03f1bfec1340aa13154003155537","source":"amazon-inspector","versions":["0.0.1-rc16"]},{"id":"IN-MAL-2026-014342","import_time":"2026-08-05T09:27:59.217636293Z","modified_time":"2026-08-05T08:36:44Z","sha256":"20e80ba76f59ca7b25d466ed171d3ef047f5dee1decc0a76441c39094dc6c799","source":"amazon-inspector","versions":["0.0.1-rc21"]},{"id":"IN-MAL-2026-014309","import_time":"2026-08-05T09:27:55.214379512Z","modified_time":"2026-08-05T08:31:55Z","sha256":"23978b08a7e3f8af97d2c8060e7fc3aca9a18d9f3435163a9d3ab97ac0b9d4d0","source":"amazon-inspector","versions":["0.0.1-rc15"]},{"id":"IN-MAL-2026-014301","import_time":"2026-08-05T09:27:53.91310724Z","modified_time":"2026-08-05T08:30:44Z","sha256":"bcc8ebc32e36b33b2e18804b02316a4a46b093350f921df3fe9a8fe58fb42de0","source":"amazon-inspector","versions":["0.0.1-rc20"]},{"id":"IN-MAL-2026-014299","import_time":"2026-08-05T09:27:53.667126652Z","modified_time":"2026-08-05T08:30:23Z","sha256":"cdbbab7489dd57c388d183f453f3aa0d2744e90b9c77beff91229f4e10a13691","source":"amazon-inspector","versions":["0.0.1-rc28"]},{"id":"IN-MAL-2026-014293","import_time":"2026-08-05T09:27:52.908447242Z","modified_time":"2026-08-05T08:29:31Z","sha256":"02c7c9fa5c471e1b4d08ca15bef1f7b3285e27866497342edefbb42a01d7fe95","source":"amazon-inspector","versions":["0.0.1-rc13"]},{"id":"IN-MAL-2026-014364","import_time":"2026-08-05T09:28:02.43771341Z","modified_time":"2026-08-05T08:39:51Z","sha256":"0afccffdcebb26b06812f5698aa5b21d9484608e3906b71580bb49ab5c6d163b","source":"amazon-inspector","versions":["0.0.1-rc6"]},{"id":"IN-MAL-2026-014316","import_time":"2026-08-05T09:27:55.956205233Z","modified_time":"2026-08-05T08:32:54Z","sha256":"c1946cf5905f62b2c8b4ffc3a6046fccc1e852ef2636b4148f6ac6736744ba4b","source":"amazon-inspector","versions":["0.0.1-rc34"]},{"id":"IN-MAL-2026-014333","import_time":"2026-08-05T09:27:58.131994107Z","modified_time":"2026-08-05T08:35:29Z","sha256":"1da3a3ca217ef4134a6cf2f710574df2916265e418742da8387430b14adcf186","source":"amazon-inspector","versions":["0.0.1-rc27"]},{"id":"IN-MAL-2026-014287","import_time":"2026-08-05T09:27:51.865639415Z","modified_time":"2026-08-05T08:28:33Z","sha256":"9cbd61c6b3244c1369cf688b99515e4e0efdb2675d27361d622e89d2ba80e460","source":"amazon-inspector","versions":["0.0.1-rc33"]},{"id":"IN-MAL-2026-014367","import_time":"2026-08-05T09:28:02.775908138Z","modified_time":"2026-08-05T08:40:16Z","sha256":"aa7cfbb5dea81433df5584af6676fff3950e05d87d0f4309c42e258dae35266a","source":"amazon-inspector","versions":["0.0.1-rc5"]},{"id":"IN-MAL-2026-014324","import_time":"2026-08-05T09:27:56.919090444Z","modified_time":"2026-08-05T08:34:03Z","sha256":"cb8053e951a495b51087f12e7e10dd73bafe49efdc7509057155888d4f30190a","source":"amazon-inspector","versions":["0.0.1-rc9"]},{"id":"IN-MAL-2026-014303","import_time":"2026-08-05T09:27:54.200721489Z","modified_time":"2026-08-05T08:31:04Z","sha256":"0d24fa0a5bc9680270d1a745260d99e8d70d1da2ee89cd42457bdc90cab48674","source":"amazon-inspector","versions":["0.0.1-rc29"]},{"id":"IN-MAL-2026-014294","import_time":"2026-08-05T09:27:53.014638582Z","modified_time":"2026-08-05T08:29:40Z","sha256":"157282dcd0238cf5bb765c8207dab98bf9270e09fe6f200d97dec894de70c230","source":"amazon-inspector","versions":["0.0.1-rc12"]},{"id":"IN-MAL-2026-014360","import_time":"2026-08-05T09:28:02.072507812Z","modified_time":"2026-08-05T08:39:15Z","sha256":"515bea46c6ee2095b2d8ba6d5355926978b5ea010f4e66d04c358070f95b405c","source":"amazon-inspector","versions":["0.0.1-rc8"]},{"id":"IN-MAL-2026-014285","import_time":"2026-08-05T09:27:51.644520605Z","modified_time":"2026-08-05T08:28:15Z","sha256":"53d7954fe0abd303d9a9034aefa2df24d506cd27bc83a16b20f95c28b24fcffc","source":"amazon-inspector","versions":["0.0.1-rc30"]},{"id":"IN-MAL-2026-014319","import_time":"2026-08-05T09:27:56.382637667Z","modified_time":"2026-08-05T08:33:19Z","sha256":"73861bb4f7119d8a4cff739f67384c5baa4dd41dca7fbb137b299ca236fa6e24","source":"amazon-inspector","versions":["0.0.1-rc32"]},{"id":"IN-MAL-2026-014321","import_time":"2026-08-05T09:27:56.595709157Z","modified_time":"2026-08-05T08:33:38Z","sha256":"803c21c3f3f283d59cfa13eb9fdf06042237995e77f0095045f705f93226105c","source":"amazon-inspector","versions":["0.0.1-rc22"]},{"id":"IN-MAL-2026-014334","import_time":"2026-08-05T09:27:58.239449531Z","modified_time":"2026-08-05T08:35:38Z","sha256":"b49a09c9c3ddcfddb9bcf9a0e6ea158dde495807d76afad99416712856d6075f","source":"amazon-inspector","versions":["0.0.1-rc26"]},{"id":"IN-MAL-2026-014297","import_time":"2026-08-05T09:27:53.402937148Z","modified_time":"2026-08-05T08:30:05Z","sha256":"a81a5a804a361c18d68d767bda893706722ae036bd3c97d1013d39d1454750d7","source":"amazon-inspector","versions":["0.0.1-rc7"]},{"id":"IN-MAL-2026-014313","import_time":"2026-08-05T09:27:55.637958382Z","modified_time":"2026-08-05T08:32:31Z","sha256":"75279ebcf38d9a2b62acb5543ee5c5a6243d38d8477b8b1b042808e1e14c2e87","source":"amazon-inspector","versions":["0.0.1-rc11"]},{"id":"IN-MAL-2026-014314","import_time":"2026-08-05T09:27:55.734788265Z","modified_time":"2026-08-05T08:32:41Z","sha256":"fe9287cf6fe34e95a771fb938c74ba8690e2da0de4e012ec1968c9089807608d","source":"amazon-inspector","versions":["0.0.1-rc10"]},{"id":"IN-MAL-2026-015887","import_time":"2026-08-05T20:07:26.572865956Z","modified_time":"2026-08-05T19:50:05Z","sha256":"197145c949835b27b6a507c0ef3f59556a786aedc1eb1416a3161db03e200218","source":"amazon-inspector","versions":["0.0.1-rc37"]},{"id":"IN-MAL-2026-016267","import_time":"2026-08-06T13:09:08.624374784Z","modified_time":"2026-08-06T12:56:07Z","sha256":"a6e1849e1f38f846328f7834b1002f6ea618302c51c4f89927abbf814e012ab4","source":"amazon-inspector","versions":["0.0.1-rc36"]},{"id":"IN-MAL-2026-017043","import_time":"2026-08-07T12:51:23.590914169Z","modified_time":"2026-08-07T12:35:38Z","sha256":"249a0362cedd0b6f7e7baa94ba3d233a23cb867a14a0389751250c3dc293fd5d","source":"amazon-inspector","versions":["0.0.1-rc39"]},{"id":"IN-MAL-2026-017060","import_time":"2026-08-07T12:51:24.47008331Z","modified_time":"2026-08-07T12:38:06Z","sha256":"8bbb481c1d433a0f97376b4e6e803a7a618d6e78eae9250a5ffa53137be65d48","source":"amazon-inspector","versions":["0.0.1-rc38"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}