Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in @ccfly/setup-linux-arm64 (npm)

The npm package @ccfly/setup-linux-arm64 contains a malicious 6.3 MB Linux ARM64 Go binary that establishes a persistent remote-access channel via WebSocket to hardcoded C2 servers (ccflycc.hn, cc.hn). The binary spawns an interactive PTY shell under remote control, intended to be deployed as an optional dependency of parent @ccfly/* packages.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Developers and systems installing @ccfly/setup-linux-arm64 as an optional dependency on Linux ARM64 platforms; any parent @ccfly/* wrapper packages that invoke the binary.
Ecosystems
npm
Attack vectors
Compromised packageMalicious commit
Affected entities
  • @ccfly/setup-linux-arm64npm package containing malicious Go binary

The package @ccfly/setup-linux-arm64 ships a 6.3 MB compiled Go binary (bin/ccfly-setup) that contains embedded libraries for PTY spawning (github.com/creack/pty) and WebSocket communication (github.com/gorilla/websocket). The binary includes hardcoded remote endpoints: ws://ccflycc.hn, wss://…, https://cc.hn, and latest.ccfly.

Upon execution, the binary establishes a WebSocket connection to the ccfly C2 infrastructure and bridges the connection to a locally spawned PTY, granting the remote operator an interactive shell on the host system. This creates a persistent remote-access channel controlled by the ccfly infrastructure operator.

The package declares platform constraints (os:linux, cpu:arm64) and includes no npm scripts or bin mappings, indicating it is designed as a platform-optional payload to be resolved as an optionalDependency of a parent @ccfly/* wrapper package. The parent package would then invoke bin/ccfly-setup during installation, activating the remote-PTY channel on the installer's machine.

The malicious package was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-68fq-2x3m-xh9h.

Indicators of compromise

Domains
  • ccflycc.hn
  • cc.hn
  • latest.ccfly

Remediation

  • Immediately uninstall @ccfly/setup-linux-arm64 and any parent @ccfly/* packages from all systems
  • Audit npm install logs and dependency trees to identify all affected installations
  • Revoke or rotate any credentials or SSH keys that may have been exposed via the remote shell
  • Monitor affected systems for unauthorized access or lateral movement
  • Block outbound connections to ccflycc.hn, cc.hn, and latest.ccfly at the network perimeter
  • Review npm audit and security advisories for related @ccfly/* packages

Sources

  1. GitHub Advisory GHSA-68fq-2x3m-xh9h · GitHub Advisory Database

Cite this entry

"Malicious code in @ccfly/setup-linux-arm64 (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 6, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-ccfly-setup-linux-arm64-npm-6xg9oz

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in pfp-forms-sme-loan (npm)

    The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.

    npmCompromised packageMalicious commit
  2. resolvedcritical

    Malicious code in twilio-hackerone-poc-afe6937c (npm)

    The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.

    npmCompromised packageMalicious commit
  3. containedcritical

    Malicious code in @wololasod/tiny-id (npm)

    The npm package @wololasod/tiny-id contained obfuscated malicious code that downloads and executes platform-specific remote executables on Windows and Linux systems. The dropper was embedded in both the main entry point (dist/index.cjs) and the TypeScript types file (dist/index.d.ts), disguised as a tiny ID generator.

    npmCompromised packageMalicious commit
  4. containedcritical

    Malicious code in akamaijs-sensor (npm)

    The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.

    npmCompromised packageMalicious commit