@ccfly/setup-linux-arm64

{"modified":"2026-08-06T13:51:36Z","published":"2026-08-06T13:51:36Z","schema_version":"1.7.4","id":"MAL-2026-13417","summary":"Malicious code in @ccfly/setup-linux-arm64 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (faefd7405c377b2260ca4d731c9234a294d8d07b559646b8fc58be5488906eec)\nThe package ships a 6.3 MB linux/arm64 Go binary at bin/ccfly-setup. The binary embeds github.com/creack/pty (PTY spawner) and github.com/gorilla/websocket alongside internal packages github.com/ccfly/rescue/internal/{agent,setup,proto}, and contains hardcoded remote endpoints ws://ccflycc.hn, wss://…, https://cc.hn, and latest.ccfly, together with strings such as 'approveccfly-*install' and '客户端已安装并配对' ('client installed and paired'). The binary dials the hardcoded ccfly server over WebSocket and bridges the connection to a locally spawned PTY, giving the remote endpoint an interactive shell on the host that runs it — a persistent remote-access channel controlled by whoever operates ccfly.hn. package.json declares os:linux, cpu:arm64, files:['bin'], and no scripts or bin map, so this sub-package alone is not auto-executed on npm install; it is a platform-optional payload intended to be resolved as an optionalDependency of a parent @ccfly/* wrapper, which then invokes bin/ccfly-setup and activates the remote-PTY channel on the installer's machine.\n","affected":[{"package":{"ecosystem":"npm","name":"@ccfly/setup-linux-arm64"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"bin/ccfly-setup","sha256":"ea8bc508e37f5894b1e5405cd286b0e178cdbbbd0d6595ef2e76a2c3d91a5da8","tlsh":"bf566b5abc1e3562d6c976352f6212957238bc4c5f82c7136a18bb3cbef27588f13261"},{"path":"package.json","sha256":"bdb35694b03222a2dbd278edbede80ec5e8ec2d6345090eee462170607a02cb6","tlsh":"a3d02b104a0a403314d8e7e05d25638dad100dd70190b48886afb10d511c7611bf69f9"}],"package_integrity":[{"filename":"setup-linux-arm64-0.1.0.tgz","hashes":{"sha1":"506665480ae5e47ec1494192b624be31c50e3b32","sha512_sri":"sha512-fO1Bqckd7/eZ/bR23N72X2F0+08N5800xaVh8PKs6GNaKES28IAPSOxGNpQkHWWcmS5zD9u0VXDJ22HLiaNqWg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ccfly/setup-linux-arm64/v/0.1.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016524","import_time":"2026-08-06T14:19:53.619982226Z","modified_time":"2026-08-06T13:51:36Z","sha256":"faefd7405c377b2260ca4d731c9234a294d8d07b559646b8fc58be5488906eec","source":"amazon-inspector","versions":["0.1.0"]}]}}