Malicious code in sextant-cli-linux-amd64 (npm)
The npm package sextant-cli-linux-amd64 contained a malicious Linux amd64 Go binary (bin/sxt) that implements a remote-controlled interactive shell via WebRTC and WebSocket, allowing attackers to execute arbitrary commands on infected systems. The binary connects to a hardcoded relay at https://relay.sextant.top/install and includes host fingerprinting via IP geolocation.
- Disclosed
- Last updated
- Blast radius
- Any system that installed the malicious sextant-cli-linux-amd64 npm package
- Ecosystems
- Attack vectors
- Affected entities
- sextant-cli-linux-amd64npm package containing malicious Linux amd64 Go binary
The npm package sextant-cli-linux-amd64 shipped a malicious Linux amd64 Go binary at bin/sxt with internal module identifier 'claude_control'. The binary was not disclosed in the package metadata and represents a supply chain compromise via npm's platform-specific binary distribution mechanism.\n\nThe payload implements a remote-controlled interactive shell by statically linking pseudo-terminal spawning (github.com/creack/pty), WebSocket communication (github.com/coder/websocket), and the full WebRTC stack (github.com/pion/webrtc/v4) with datachannel, ICE, DTLS, STUN, and TURN support. The binary connects to a hardcoded relay at https://relay.sextant.top/install, allowing a remote peer that reaches the relay to drive a full TTY on the installer's machine.\n\nThe binary also references http://ip-api.com/json/ to fingerprint the host at startup. The package name does not reference 'claude_control' or the associated GitHub user 'ddos798', obscuring the true nature of the payload.\n\nThe incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- sextant-cli-linux-amd64
- Domains
- relay.sextant.top
- ip-api.com
Remediation
- Immediately uninstall sextant-cli-linux-amd64 from all systems
- Audit npm package.json and lock files for any installations of sextant-cli-linux-amd64
- Assume any system that installed this package has been compromised; perform forensic analysis and credential rotation
- Monitor for outbound connections to relay.sextant.top and ip-api.com from affected systems
- Review npm audit logs and consider enabling 2FA on npm accounts
- Use npm package integrity verification and consider using private registries or package allowlists
Sources
- GitHub Advisory GHSA-g6xw-m38g-gq9x · GitHub Advisory Database
Cite this entry
"Malicious code in sextant-cli-linux-amd64 (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-sextant-cli-linux-amd64-npm-1b1oyq
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in svelte-dim-kit
The npm package svelte-dim-kit was found to contain malware, potentially giving attackers full control of affected systems. All systems with this package installed should be considered compromised and secrets/keys rotated immediately from a different computer.
npmCompromised package - containedcritical
Malicious code in @syncraft-labs/react (npm)
The npm package @syncraft-labs/react contained obfuscated malicious code in its ESM distribution that implements the EtherHiding pattern, fetching and executing arbitrary code from an Ethereum smart contract via RPC endpoints. The tampering occurred post-build in the dist/index.js artifact.
npmCompromised package - containedcritical
Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in stillm4ddpocs-rtest-bravo (npm)
The npm package stillm4ddpocs-rtest-bravo contained malicious code in its preinstall script that automatically executed during installation, collecting system information and internal package metadata and exfiltrating it to a third-party Interactsh collector via HTTPS and DNS tunneling.
npmCompromised package