Malicious code in sextant-cli-darwin-amd64 (npm)
The npm package sextant-cli-darwin-amd64 contained a malicious Go binary that established remote shell access via hardcoded C2 endpoints and harvested Anthropic API keys and Claude CLI configuration from infected systems.
- Disclosed
- Last updated
- Blast radius
- Developers and systems that installed sextant-cli-darwin-amd64 from npm; potential exposure of Anthropic API keys and Claude CLI configuration.
- Ecosystems
- Attack vectors
- Affected entities
- sextant-cli-darwin-amd64npm package containing malicious Go binary
The npm package sextant-cli-darwin-amd64 shipped a malicious Go binary (bin/sxt) that provided full remote shell access to attackers. The binary opened WebSocket/WebRTC connections to hardcoded C2 endpoints at wss://relay.sextant.top and https://relay.sextant.top/install, spawning a pseudo-terminal (PTY) controlled by remote commands.\n\nThe malicious binary also harvested credentials and configuration data from infected systems. It embedded a regex pattern to extract Anthropic API keys (sk-ant-[a-z0-9]+-[A-Za-z0-9_-]{40,}) and searched for Claude CLI configuration files in the user's home directory, targeting CLAUDE_CONFIG_DIR and settings.local. The binary queried api.anthropic.com/v1/models and claude.ai endpoints.\n\nAdditional reconnaissance capabilities included geolocation and ISP profiling via http://ip-api.com/json/. The package.json referenced https://github.com/ddos798/claude_control, self-identifying the malicious tooling. Strings in the binary referenced https://claude.ai/install.sh and the npm registry, indicating a self-update and dropper mechanism for payload swaps.\n\nThe incident was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-7x22-xp2x-5r35.
Indicators of compromise
- Packages
- sextant-cli-darwin-amd64
- Domains
- relay.sextant.top
- api.anthropic.com
- claude.ai
- ip-api.com
- registry.npmjs.org
- Hashes
- 4da71f2071285bfe8543d8aa7437f2b82111d95797f78ece2cf7498d02ff9cc1
Remediation
- Immediately uninstall sextant-cli-darwin-amd64 from all systems
- Rotate all Anthropic API keys that may have been exposed
- Review Claude CLI configuration and authentication tokens for unauthorized access
- Audit system logs for suspicious WebSocket/WebRTC connections to relay.sextant.top
- Check for unauthorized remote shell sessions or PTY spawning in system logs
- Scan systems for persistence mechanisms or additional malicious payloads
- Review npm package installation logs to identify affected users and systems
Sources
- GitHub Advisory GHSA-7x22-xp2x-5r35 · GitHub Advisory Database
Cite this entry
"Malicious code in sextant-cli-darwin-amd64 (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-sextant-cli-darwin-amd64-npm-144yj7
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in santana-baileys (npm)
Malicious code discovered in santana-baileys npm package that covertly relays WhatsApp messaging data to an attacker-controlled endpoint (https://fiora.nixel.my.id/) via obfuscated character-code reconstruction in the message-send code path.
npmCompromised package - resolvedcritical
Malicious code in elephant-tusk-runner (npm)
The npm package elephant-tusk-runner contained malicious code that exposed a remote shell and remote code execution surface via an unauthenticated Express + WebSocket server binding to 0.0.0.0:4201 with fully open CORS. Any peer able to reach the port could execute arbitrary commands on the host.
npmCompromised package - resolvedcritical
Malicious code in @cats-cdf/browser-metrics-meter (npm)
The npm package @cats-cdf/browser-metrics-meter contained malicious code in its preinstall lifecycle script that exfiltrated system reconnaissance data (username, hostname, public IP) to an OAST collector domain. The package executed this behavior unconditionally on installation without consent or documented purpose.
npmCompromised package - resolvedcritical
Malicious code in @ks-video/kwai-player-web (npm)
The npm package @ks-video/kwai-player-web contained malicious code in its postinstall hook that exfiltrated system reconnaissance data (hostname, username, working directory, network interfaces, environment variable names) over plain HTTP to an unrelated third-party domain. The package has no legitimate relationship to the declared publisher Kwai/@ks-video.
npmCompromised package