Malicious code in sextant-cli-linux-amd64 (npm)

The npm package sextant-cli-linux-amd64 shipped a malicious Linux amd64 Go binary at bin/sxt with internal module identifier 'claude_control'. The binary was not disclosed in the package metadata and represents a supply chain compromise via npm's platform-specific binary distribution mechanism.\n\nThe payload implements a remote-controlled interactive shell by statically linking pseudo-terminal spawning (github.com/creack/pty), WebSocket communication (github.com/coder/websocket), and the full WebRTC stack (github.com/pion/webrtc/v4) with datachannel, ICE, DTLS, STUN, and TURN support. The binary connects to a hardcoded relay at https://relay.sextant.top/install, allowing a remote peer that reaches the relay to drive a full TTY on the installer's machine.\n\nThe binary also references http://ip-api.com/json/ to fingerprint the host at startup. The package name does not reference 'claude_control' or the associated GitHub user 'ddos798', obscuring the true nature of the payload.\n\nThe incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.