@ccfly/setup-linux-x64

{"modified":"2026-08-06T14:21:50Z","published":"2026-08-06T13:51:43Z","schema_version":"1.7.4","id":"MAL-2026-13418","summary":"Malicious code in @ccfly/setup-linux-x64 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (33138ee17148f975a7c0b34f5d6ee1a4ad082395b87872dc91de0778130b91c8)\nThe tarball ships a single 6.9 MB linux/x64 Go executable at bin/ccfly-setup and no source. The binary links github.com/creack/pty (PTY spawning) and github.com/gorilla/websocket (WebSocket client), and contains hardcoded destinations ws://ccflycc.hn, wss://, and https://cc.hn along with strings that drive apt-get/pacman/zypper package installs after a remote 'approve' step (including a Chinese status string meaning 'client installed and paired'). This is a remote-controlled shell/executor architecture: a persistent WebSocket to a vendor-controlled server plus a local PTY and privileged package-manager invocations give whoever controls ccflycc.hn / cc.hn full command execution and privileged package installation on the host running the binary. package.json declares only {os:[linux], cpu:[x64], files:[bin]} with no scripts, main, or bin field, so `npm install` does not by itself execute the binary; the backdoor activates when the companion @ccfly/* wrapper CLI resolves this optionalDependency and invokes bin/ccfly-setup. The delivery uses plain ws:// in addition to wss://, and no source is shipped for independent audit.\n","affected":[{"package":{"ecosystem":"npm","name":"@ccfly/setup-linux-x64"},"versions":["0.1.4","0.1.3","0.1.9","0.1.0","0.1.1","0.1.10","0.1.17","0.1.19","0.1.14","0.1.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"bin/ccfly-setup","sha256":"fa5f9e252b4b2ca17fe3db33e92b8d96585c86eff4bf6be281fec71077b7b867","tlsh":"8a664917fca525e9c0ae913189639513bf727c494b3123d35f90ba283f76bd0aab9740"},{"path":"package.json","sha256":"159efe1f2a326113006d6e651bf4185ba825fb3753a12e8a281107779db9a126","tlsh":"d8d02b214919813316d8eb905c21434d6d100d920190748c8ebf210c512c76159f6af9"}],"package_integrity":[{"filename":"setup-linux-x64-0.1.4.tgz","hashes":{"sha1":"c28f6659398e2b0fb13c219319aacb257cb3ca4d","sha512_sri":"sha512-01v35tGwt/OWOUAsbgha2mAIA1hGdinx8P1mKo3z0QRkG9rBRd7vNg0u3QzSY+BZF/Bs8p46njBSdPd6Hrrm1g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.9"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.10"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.17"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.19"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.14"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016528","import_time":"2026-08-06T14:19:53.804217599Z","modified_time":"2026-08-06T13:52:11Z","sha256":"296e1b146603b0e56bada239257839e6c404720a263d3cf467a727397870f022","source":"amazon-inspector","versions":["0.1.4"]},{"id":"IN-MAL-2026-016529","import_time":"2026-08-06T14:19:53.837368657Z","modified_time":"2026-08-06T13:52:24Z","sha256":"33138ee17148f975a7c0b34f5d6ee1a4ad082395b87872dc91de0778130b91c8","source":"amazon-inspector","versions":["0.1.3"]},{"id":"IN-MAL-2026-016526","import_time":"2026-08-06T14:19:53.715108564Z","modified_time":"2026-08-06T13:51:51Z","sha256":"5431775fbfb5393064dfa86e71467919e31bc482ca063b7becb39314dba4ff9f","source":"amazon-inspector","versions":["0.1.9"]},{"id":"IN-MAL-2026-016525","import_time":"2026-08-06T14:19:53.658722047Z","modified_time":"2026-08-06T13:51:43Z","sha256":"b4d7aa40a791ac6747d32cf63e15018433ac384c673c2587d6d7aa1db2889819","source":"amazon-inspector","versions":["0.1.0"]},{"id":"IN-MAL-2026-016532","import_time":"2026-08-06T14:19:54.026111431Z","modified_time":"2026-08-06T13:52:52Z","sha256":"ccb15b24f68c411ed5952e93adfb149b226298e8812b32a3293308878d87240c","source":"amazon-inspector","versions":["0.1.1"]},{"id":"IN-MAL-2026-016533","import_time":"2026-08-06T14:19:54.063680206Z","modified_time":"2026-08-06T13:53:01Z","sha256":"cf67bf381e483cbe273650f4d3af480e113639709c85c6360e7d06388a7b3143","source":"amazon-inspector","versions":["0.1.10"]},{"id":"IN-MAL-2026-016534","import_time":"2026-08-06T14:19:54.104307434Z","modified_time":"2026-08-06T13:53:11Z","sha256":"5208fc1432f95ef04a90f0cda3cd92b45196ba8e3358ce0ec36b249ef5b95a01","source":"amazon-inspector","versions":["0.1.17"]},{"id":"IN-MAL-2026-016531","import_time":"2026-08-06T14:19:53.964501895Z","modified_time":"2026-08-06T13:52:45Z","sha256":"82bc092752f32a5ed0564c69bce8ef621d63ab9b89d5a1b74a00710d66bb4ada","source":"amazon-inspector","versions":["0.1.19"]},{"id":"IN-MAL-2026-016527","import_time":"2026-08-06T14:19:53.749459592Z","modified_time":"2026-08-06T13:51:59Z","sha256":"9632eb35be0c9ea25d90fa7dc0fe9ecd4eaa3b44b0fba5616cb399429d032315","source":"amazon-inspector","versions":["0.1.14"]},{"id":"IN-MAL-2026-016530","import_time":"2026-08-06T14:19:53.876140322Z","modified_time":"2026-08-06T13:52:37Z","sha256":"c5b8ba92b0192289b9bd7316dcf6fd8964a52fbbbcf50845208501181917800a","source":"amazon-inspector","versions":["0.1.2"]}]}}