Malicious code in sextant-cli-darwin-arm64 (npm)
The npm package sextant-cli-darwin-arm64 contained a malicious Go binary that establishes a WebSocket connection to a hardcoded relay server, enabling remote code execution and credential theft. The binary specifically targets Anthropic API keys and exposes a PTY/WebSocket interface on multiple local network ports.
- Disclosed
- Last updated
- Blast radius
- Developers and systems that installed sextant-cli-darwin-arm64 from npm; exposure of Anthropic API credentials and full remote code execution capability on affected hosts.
- Ecosystems
- Attack vectors
- Affected entities
- sextant-cli-darwin-arm64npm package containing malicious darwin/arm64 Go binary
The npm package sextant-cli-darwin-arm64 shipped a darwin/arm64 Go binary with embedded malicious functionality. The binary opens an outbound WebSocket connection to a hardcoded relay at wss://relay.sextant.top, linking PTY and WebSocket libraries to implement a network-driven pseudo-terminal remote-shell pattern that grants full code execution to the relay operator.\n\nThe malicious binary binds listeners on 0.0.0.0:7280, 0.0.0.0:7281, and 0.0.0.0:9000, exposing the PTY/WebSocket interface to the local network rather than restricting it to loopback. Embedded regex patterns specifically target Anthropic API keys (matching 'sk-ant-[a-z0-9]+-[A-Za-z0-9_-]{40,}'), and the binary references CLAUDE_CONFIG_DIR and ~/.claude paths to extract installer credentials, which are then accessible via the relay channel.\n\nAdditional telemetry functionality sends POST requests to https://relay.sextant.top/install and queries http://ip-api.com/json to report installer geolocation and host identity to the attacker. The package metadata falsely describes it as a 'Sextant (sxt) binary for darwin/arm64', while the license field points to a GitHub repository named 'claude_control', indicating intent to control Claude Code and Gemini CLI sessions.\n\nThe incident was identified by Amazon Inspector and published as GitHub Advisory GHSA-2qg7-5p3x-vr75 on 2026-08-05.
Indicators of compromise
- Packages
- sextant-cli-darwin-arm64
- Domains
- relay.sextant.top
- ip-api.com
Remediation
- Immediately uninstall sextant-cli-darwin-arm64 from all systems
- Revoke all Anthropic API keys that may have been exposed on affected hosts
- Audit network logs for outbound WebSocket connections to relay.sextant.top and IP-API queries
- Block relay.sextant.top and ip-api.com at the network perimeter if not otherwise needed
- Review system logs for unexpected processes binding to ports 7280, 7281, and 9000
- Rotate credentials for any services accessed from affected systems
- Monitor for unauthorized access to Claude Code or Gemini CLI sessions
Sources
- GitHub Advisory GHSA-2qg7-5p3x-vr75 · GitHub Advisory Database
Cite this entry
"Malicious code in sextant-cli-darwin-arm64 (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-sextant-cli-darwin-arm64-npm-121e6g
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in twapfetch (npm)
twapfetch@1.1.0 on npm contains a malicious postinstall script that downloads and executes arbitrary code from a mutable, author-controlled URL with no integrity verification. The package misrepresents its purpose (claiming to be a Polymarket Chainlink TWAP client) while actually shipping Kelly-stake math helpers and a remote-bundle loader.
npmCompromised packageMalicious maintainer - containedcritical
Malicious code in sysdo (npm)
The npm package sysdo was published with malicious code that installs a Windows surveillance harness disguised as a system configuration tool. The payload captures keyboard input, clipboard contents, screenshots, and UI text, exfiltrating data to a hardcoded endpoint controlled by the attacker.
npmCompromised packageMalicious maintainer - resolvedcritical
Malicious code in blekit (npm)
The npm package blekit contained malicious code that silently exfiltrated application logs, GPS coordinates, device identifiers, and security posture to an attacker-controlled Telegram channel. The package re-exported logger functions that POSTed all logged strings to Telegram, and exposed device-info helpers that gathered and transmitted precise location and device metadata without user or developer consent.
npmCompromised packageMalicious maintainer - resolvedcritical
Malicious code in vite-vue-path-map (npm)
The npm package vite-vue-path-map contained malicious code that injected obfuscated JavaScript into production builds. The injected code sent beacons to an attacker-controlled domain and could remotely deface any site built with the compromised plugin.
npmCompromised packageMalicious maintainer