Malicious code in @ccfly/setup-darwin-x64 (npm)
The npm package @ccfly/setup-darwin-x64 contained a malicious prebuilt Go binary that established remote shell access to infected hosts via WebSocket connections to hardcoded brokers (cc.hn, ccfly). The binary could fetch and execute additional code chosen by the remote attacker after enrollment token approval.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed @ccfly/setup-darwin-x64 from npm
- Ecosystems
- Attack vectors
- Affected entities
- @ccfly/setup-darwin-x64npm package containing malicious prebuilt darwin/x64 Mach-O binary
The @ccfly/setup-darwin-x64 npm package shipped a prebuilt darwin/x64 Mach-O binary containing a Go agent (github.com/ccfly/rescue) that, when executed, connected to hardcoded remote brokers at cc.hn and ccfly over WebSocket (ws://ccfly, wss://, https://cc.hn). The binary used github.com/gorilla/websocket and github.com/creack/pty to spawn a pseudo-terminal and pipe the WebSocket stream into it, granting the remote party interactive shell control of the host.
A second-stage payload mechanism (setup.downloadCcfly, setup.fetchAndExtract, setup.npmTarballURL, setup.extractFromTarGz, setup.runCcflyInstall, setup.redeemEnrollToken) fetched and executed additional ccfly npm tarballs after the broker approved an enrollment token. The additional code executed on the host was chosen by the remote broker, not the installer, enabling arbitrary code execution.
The binary also performed reconnaissance by inspecting shell RC files and /etc/hosts (setup.scanShellProfilesForProxy, setup.checkProxyResidue, setup.checkHostsResidue, setup.runEnvChecks) and POSTed an environment report back to the broker (setup.(*brokerClient).post), allowing the attacker to profile the target environment before deploying further payloads.
The malicious package was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- @ccfly/setup-darwin-x64
- Domains
- cc.hn
- ccfly
Remediation
- Immediately uninstall @ccfly/setup-darwin-x64 from all systems and CI/CD pipelines
- Audit npm package.json and lock files for any presence of @ccfly/setup-darwin-x64 or related packages
- Review shell history and process logs on any macOS systems that may have executed this package
- Check /etc/hosts and shell RC files (.bashrc, .zshrc, etc.) for unauthorized modifications
- Monitor network traffic for connections to cc.hn, ccfly, or related domains
- Regenerate any credentials or tokens that may have been exposed on affected systems
- Review npm account access logs and consider rotating authentication tokens if the account was compromised
Sources
- GitHub Advisory GHSA-87c6-7qmm-v69p · GitHub Advisory Database
Cite this entry
"Malicious code in @ccfly/setup-darwin-x64 (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 6, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-ccfly-setup-darwin-x64-npm-145rgj
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in @wololasod/tiny-id (npm)
The npm package @wololasod/tiny-id contained obfuscated malicious code that downloads and executes platform-specific remote executables on Windows and Linux systems. The dropper was embedded in both the main entry point (dist/index.cjs) and the TypeScript types file (dist/index.d.ts), disguised as a tiny ID generator.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit - containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit