Malicious code in @ccfly/setup-darwin-arm64 (npm)

The npm package @ccfly/setup-darwin-arm64 shipped a malicious Go binary (bin/ccfly-setup) targeting macOS ARM64 systems. The binary contains hardcoded WebSocket connections to cc.hn and implements a full remote-control channel that executes arbitrary commands received from the attacker's infrastructure.\n\nBeyond remote command execution, the binary also intercepts Anthropic/Claude API credentials and session tokens by establishing a local HTTPS listener on 127.0.0.1:443 and modifying shell configuration files (~/.zshrc, ~/.bash_profile) to route API requests through the attacker-controlled cc.hn server. This allows the attacker to capture user API keys, session tokens, and prompt content.\n\nThe package itself declares no npm scripts or bin entry, so the malicious binary is not automatically executed by npm install alone. However, when the parent @ccfly/setup CLI is invoked by the user, it triggers execution of the binary, activating both the remote command execution and credential interception mechanisms.\n\nThe presence of Chinese pairing prompts ('请在网页上点「批准这台电脑」完成配对') indicates the attack flow involves remote pairing of the compromised host to the attacker's console, giving persistent access and credential relay capabilities.