sextant-cli-darwin-amd64

{"schema_version":"1.7.4","id":"MAL-2026-12028","published":"2026-08-05T00:09:51Z","modified":"2026-08-07T12:53:22.636078299Z","summary":"Malicious code in sextant-cli-darwin-amd64 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9d2e5ab6503eb2b9c12bf64e34cb2fe12227c07b179231ebe23f13b8866181f1)\nThe tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main, no bin mapping, and no scripts — the package is a platform-artifact shipped for consumption as an optionalDependency by a parent sextant-cli. Strings extracted from bin/sxt show it embeds github.com/coder/websocket and github.com/creack/pty together with the hardcoded relay URL wss://relay.sextant.top; that network-to-PTY dataflow is a remote-shell backdoor driven by an attacker-controlled WebSocket relay on the installer's host. The same binary contains the Anthropic API-key regex sk-ant-[a-z0-9]+-[A-Za-z0-9_-]{40,} alongside CLAUDE_CONFIG_DIR=, https://claude.ai/, and https://api.anthropic.com/v1/models, indicating the binary reads the installer's Claude configuration directory and fingerprints sk-ant-* credentials for exfiltration through the same relay. Additional strings embed http://ip-api.com/json/?fields=status,message,country,countryCode,city,timezone,isp,org,as,proxy,hosting,mobile,query, profiling the installer's public IP, city, ISP, org, ASN, and hosting/proxy flags. package.json declares its license as SEE LICENSE IN https://github.com/ddos798/claude_control, and the binary references https://claude.ai/install.sh and https://registry.npmjs.org/sextant-cli/latest for self-update. Delivering behavior only as a stripped compiled binary conceals the network-to-PTY, credential-regex, and geolocation logic from JS-level inspection.\n","affected":[{"package":{"name":"sextant-cli-darwin-amd64","ecosystem":"npm"},"versions":["0.0.1-rc34","0.0.1-rc31","0.0.1-rc10","0.0.1-rc16","0.0.1-rc11","0.0.1-rc12","0.0.1-rc26","0.0.1-rc6","0.0.1-rc24","0.0.1-rc22","0.0.1-rc14","0.0.1-rc23","0.0.1-rc19","0.0.1-rc35","0.0.1-rc18","0.0.1-rc20","0.0.1-rc27","0.0.1-rc21","0.0.1-rc25","0.0.1-rc13","0.0.1-rc28","0.0.1-rc7","0.0.1-rc29","0.0.1-rc30","0.0.1-rc17","0.0.1-rc8","0.0.1-rc33","0.0.1-rc9","0.0.1-rc32","0.0.1-rc5","0.0.1-rc15","0.0.1-rc36","0.0.1-rc37","0.0.1-rc39","0.0.1-rc38"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"bin/sxt","sha256":"c92a337b75dfd7f1f66f5d52628d89d994acd20193e368e722be39f5fcc40c3d","tlsh":"dcd64b57eca945e9c4adc1358ab696237b317c494b2033d31b60f6243f73be0aab9750"},{"path":"package.json","sha256":"24320f79a9c15b9705d5e9fe14f32345897cd64d744921349341a25287d4d45d","tlsh":"f7d0a765866461725ef84bd05d72900d62308d155806745d7bbb354c122e5b2a9f9228"}],"package_integrity":[{"filename":"sextant-cli-darwin-amd64-0.0.1-rc34.tgz","hashes":{"sha1":"0f6afad0da77412b11eda4d6ea43fae6ff681a79","sha512_sri":"sha512-ev30GHEq/iLBTqp091ff6UJT7MNeAmNlug/1vKEKAiR+ru7GkvHsxJFCwKlIM/VPJbVcoAWgpLuB/Yszplw8kg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc34"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc31"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc10"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc16"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc11"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc12"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc26"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc24"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc22"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc14"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc23"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc19"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc35"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc18"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc20"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc27"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc21"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc25"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc13"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc28"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc29"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc30"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc17"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc8"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc33"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc9"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc32"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc15"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc36"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc37"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc39"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sextant-cli-darwin-amd64/v/0.0.1-rc38"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-011398","import_time":"2026-08-05T00:44:43.406723846Z","modified_time":"2026-08-05T00:09:51Z","sha256":"4da71f2071285bfe8543d8aa7437f2b82111d95797f78ece2cf7498d02ff9cc1","source":"amazon-inspector","versions":["0.0.1-rc34"]},{"id":"IN-MAL-2026-014305","import_time":"2026-08-05T09:27:54.549258643Z","modified_time":"2026-08-05T08:31:19Z","sha256":"8ec015aabfc62dff864495c55a843f27de7ad643be1cd16c847542d2b492276f","source":"amazon-inspector","versions":["0.0.1-rc31"]},{"id":"IN-MAL-2026-014357","import_time":"2026-08-05T09:28:01.709442228Z","modified_time":"2026-08-05T08:38:55Z","sha256":"beb6fac9ef14e4420488f91db4a3611492970a0391a7ed525f2093e1639cd0d4","source":"amazon-inspector","versions":["0.0.1-rc10"]},{"id":"IN-MAL-2026-014290","import_time":"2026-08-05T09:27:52.552004509Z","modified_time":"2026-08-05T08:29:03Z","sha256":"cea82d3f63d4bfc12706277fb9b372fb921233bc8e6e7da0df30d2fec4143d45","source":"amazon-inspector","versions":["0.0.1-rc16"]},{"id":"IN-MAL-2026-014322","import_time":"2026-08-05T09:27:56.693937681Z","modified_time":"2026-08-05T08:33:47Z","sha256":"176744255653f7306997ec4017221942d5262fe934ef6972e55e93ca46fe4272","source":"amazon-inspector","versions":["0.0.1-rc11"]},{"id":"IN-MAL-2026-014356","import_time":"2026-08-05T09:28:01.512373863Z","modified_time":"2026-08-05T08:38:45Z","sha256":"3c0a77e02596335bf566a31445467cab1dce963b7e753fbc067cc330c82a37cc","source":"amazon-inspector","versions":["0.0.1-rc12"]},{"id":"IN-MAL-2026-014300","import_time":"2026-08-05T09:27:53.810518245Z","modified_time":"2026-08-05T08:30:35Z","sha256":"b69236fcb44cf363593c779d36704726a28c68d0bf15fc986810575c285c6387","source":"amazon-inspector","versions":["0.0.1-rc26"]},{"id":"IN-MAL-2026-014366","import_time":"2026-08-05T09:28:02.680037086Z","modified_time":"2026-08-05T08:40:09Z","sha256":"643e2c52a14d58d361874e0746d53c7fba136fc7dd8655bea0e6b12b3f6cc32c","source":"amazon-inspector","versions":["0.0.1-rc6"]},{"id":"IN-MAL-2026-014291","import_time":"2026-08-05T09:27:52.703500813Z","modified_time":"2026-08-05T08:29:10Z","sha256":"062689c7eb753d43d7319f042585d39b929e14cf0d609da842bc0f35499aab06","source":"amazon-inspector","versions":["0.0.1-rc24"]},{"id":"IN-MAL-2026-014341","import_time":"2026-08-05T09:27:59.084314448Z","modified_time":"2026-08-05T08:36:36Z","sha256":"7487ed84a2ee2c397adc615962e85086a371e6108378b5298179d73805cb8353","source":"amazon-inspector","versions":["0.0.1-rc22"]},{"id":"IN-MAL-2026-014311","import_time":"2026-08-05T09:27:55.420080356Z","modified_time":"2026-08-05T08:32:12Z","sha256":"d0a4579ae1dd2ccffaf28302af4e1565775241f9b1d0c5e861df2c8554227c57","source":"amazon-inspector","versions":["0.0.1-rc14"]},{"id":"IN-MAL-2026-014320","import_time":"2026-08-05T09:27:56.498527746Z","modified_time":"2026-08-05T08:33:30Z","sha256":"e0a1ca6f4e48ee3ee376c62bf04d229eef9b9c28c4d5704aeb01efbf4b963f94","source":"amazon-inspector","versions":["0.0.1-rc23"]},{"id":"IN-MAL-2026-014306","import_time":"2026-08-05T09:27:54.684835284Z","modified_time":"2026-08-05T08:31:29Z","sha256":"0dbc296faa091033a145f485d51789ead79b91716bb0ddbbbbaec38bcfe990c4","source":"amazon-inspector","versions":["0.0.1-rc19"]},{"id":"IN-MAL-2026-014296","import_time":"2026-08-05T09:27:53.206722485Z","modified_time":"2026-08-05T08:29:55Z","sha256":"08ab037c781a77b323dc720da773cdbd283b8104a6ceaba93eab09b2dde7644b","source":"amazon-inspector","versions":["0.0.1-rc35"]},{"id":"IN-MAL-2026-014292","import_time":"2026-08-05T09:27:52.80472926Z","modified_time":"2026-08-05T08:29:21Z","sha256":"52ab46f4de0ab24a68d3cd1db4e6b752e39db8a870a4df1ace5575fdd2400e0f","source":"amazon-inspector","versions":["0.0.1-rc18"]},{"id":"IN-MAL-2026-014289","import_time":"2026-08-05T09:27:52.323936837Z","modified_time":"2026-08-05T08:28:50Z","sha256":"7c2ffb43db99172500191d797e6c3d6e189dc78b9d5f1973411031d36507d159","source":"amazon-inspector","versions":["0.0.1-rc20"]},{"id":"IN-MAL-2026-014332","import_time":"2026-08-05T09:27:57.930079975Z","modified_time":"2026-08-05T08:35:19Z","sha256":"9d2e5ab6503eb2b9c12bf64e34cb2fe12227c07b179231ebe23f13b8866181f1","source":"amazon-inspector","versions":["0.0.1-rc27"]},{"id":"IN-MAL-2026-014304","import_time":"2026-08-05T09:27:54.370855128Z","modified_time":"2026-08-05T08:31:11Z","sha256":"e17a84407d1c8b91240f6eb38704bcf11e7bed3b3ed38c90ac727f5526b7b2d0","source":"amazon-inspector","versions":["0.0.1-rc21"]},{"id":"IN-MAL-2026-014336","import_time":"2026-08-05T09:27:58.625562327Z","modified_time":"2026-08-05T08:35:54Z","sha256":"ef741ddc2626420bbf83f3b8d99f2c1f22f347e438bb959021dfea8f9d03a3c6","source":"amazon-inspector","versions":["0.0.1-rc25"]},{"id":"IN-MAL-2026-014312","import_time":"2026-08-05T09:27:55.547916011Z","modified_time":"2026-08-05T08:32:23Z","sha256":"fd14e772b597978bb7f59bf8f2a70d91655099210af716036b9d596a0a99a6c0","source":"amazon-inspector","versions":["0.0.1-rc13"]},{"id":"IN-MAL-2026-014331","import_time":"2026-08-05T09:27:57.775860551Z","modified_time":"2026-08-05T08:35:10Z","sha256":"38084d2ddef3a61c81d025e654545d07bbba773fb89e04cdadfdd9d82c922011","source":"amazon-inspector","versions":["0.0.1-rc28"]},{"id":"IN-MAL-2026-014362","import_time":"2026-08-05T09:28:02.264416666Z","modified_time":"2026-08-05T08:39:35Z","sha256":"67e09f48d2a485c796f3872b327e86a5523ee69bb4289fe9e3033f0f3cd43ecf","source":"amazon-inspector","versions":["0.0.1-rc7"]},{"id":"IN-MAL-2026-014302","import_time":"2026-08-05T09:27:54.043981251Z","modified_time":"2026-08-05T08:30:54Z","sha256":"b703b004ecba01397c378b3e56d9f22d7f4e822c14d3ce58e40513730000952f","source":"amazon-inspector","versions":["0.0.1-rc29"]},{"id":"IN-MAL-2026-014318","import_time":"2026-08-05T09:27:56.272485198Z","modified_time":"2026-08-05T08:33:11Z","sha256":"4a08fb404b42923ca00d403a2e93d904ed6694ce245a0bb81fc58a21757bfb4b","source":"amazon-inspector","versions":["0.0.1-rc30"]},{"id":"IN-MAL-2026-014307","import_time":"2026-08-05T09:27:54.950781251Z","modified_time":"2026-08-05T08:31:38Z","sha256":"6d19f5aab58eb6b8a605b2133a9074e474ea395bb78cff25fba0cf57374eba39","source":"amazon-inspector","versions":["0.0.1-rc17"]},{"id":"IN-MAL-2026-014315","import_time":"2026-08-05T09:27:55.842058771Z","modified_time":"2026-08-05T08:32:48Z","sha256":"8110d0d64570cbfdd0e1b6da8166e5b3e01060908766f038338af489ecaae71d","source":"amazon-inspector","versions":["0.0.1-rc8"]},{"id":"IN-MAL-2026-014286","import_time":"2026-08-05T09:27:51.741238027Z","modified_time":"2026-08-05T08:28:23Z","sha256":"955711067836acd1442fa265aff200afe40023a7e65f210298bdb87ef8fe1942","source":"amazon-inspector","versions":["0.0.1-rc33"]},{"id":"IN-MAL-2026-014323","import_time":"2026-08-05T09:27:56.815579759Z","modified_time":"2026-08-05T08:33:55Z","sha256":"b3efc75b637a6953d87fb80a3308ec47fb0a27985c9dc22af68ef082feae9080","source":"amazon-inspector","versions":["0.0.1-rc9"]},{"id":"IN-MAL-2026-014284","import_time":"2026-08-05T09:27:51.541836677Z","modified_time":"2026-08-05T08:28:03Z","sha256":"c719c58e060f4978dbf3384521ba75e955ee49796c73ef1a26aef224b5c5c565","source":"amazon-inspector","versions":["0.0.1-rc32"]},{"id":"IN-MAL-2026-014369","import_time":"2026-08-05T09:28:02.979761621Z","modified_time":"2026-08-05T08:40:29Z","sha256":"3e363ee49349bb2fa8d05d057995bb419385be364e1899c71fe51be8f23027b5","source":"amazon-inspector","versions":["0.0.1-rc5"]},{"id":"IN-MAL-2026-014310","import_time":"2026-08-05T09:27:55.32575572Z","modified_time":"2026-08-05T08:32:02Z","sha256":"77e89f39191222fe553f7ae17512bb9b97566702de7c26c50538a4605e9135f3","source":"amazon-inspector","versions":["0.0.1-rc15"]},{"id":"IN-MAL-2026-014644","import_time":"2026-08-05T13:08:33.247579077Z","modified_time":"2026-08-05T12:24:41Z","sha256":"d9e92f0e4d8bf5d9f5237d632b2c9c106705654fa0d463796a8e5b0accade86f","source":"amazon-inspector","versions":["0.0.1-rc36"]},{"id":"IN-MAL-2026-015885","import_time":"2026-08-05T20:07:26.484975469Z","modified_time":"2026-08-05T19:49:44Z","sha256":"084aa59226b6f1c91e205d09ed3af1076691f739a14ff70485e6459ab295c9dd","source":"amazon-inspector","versions":["0.0.1-rc37"]},{"id":"IN-MAL-2026-017041","import_time":"2026-08-07T12:51:23.471798847Z","modified_time":"2026-08-07T12:35:19Z","sha256":"90397ffd4e0dac7ae0725feb608c5f7800510d886567abcbf714b47483baa0de","source":"amazon-inspector","versions":["0.0.1-rc39"]},{"id":"IN-MAL-2026-017040","import_time":"2026-08-07T12:51:23.369165186Z","modified_time":"2026-08-07T12:35:10Z","sha256":"0339098220f110c278095abb49998ef402f2563fbaaa8facfd76c944367475e4","source":"amazon-inspector","versions":["0.0.1-rc38"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}