Malicious code in sextant-cli-linux-arm64 (npm)

The npm package sextant-cli-linux-arm64 was found to contain malicious code in the form of a Linux ARM64 Go executable (sxt). The binary was designed to establish an interactive reverse shell connection to a hardcoded WebSocket relay at wss://relay.sextant.top, allowing remote operators to execute arbitrary commands on infected systems.\n\nThe malicious binary includes multiple capabilities beyond remote shell access. It embeds libraries for PTY spawning (github.com/creack/pty), WebSocket communication (github.com/coder/websocket), and a full WebRTC stack (github.com/pion/webrtc/v4) with DataChannel, DTLS, STUN, and TURN support. The binary also contains hardcoded strings and regex patterns for harvesting AI CLI credentials, specifically targeting Anthropic API keys (prefix sk-ant-) and Google Gemini CLI credentials, along with references to system files like passwd, shadow, and shell history.\n\nAdditional reconnaissance capabilities include IP geolocation fingerprinting via http://ip-api.com/json/, which collects the installer's public IP, country, city, and timezone. The package.json file references a license URL pointing to https://github.com/ddos798/claude_control, indicating the underlying malicious repository.\n\nThe package name sextant-cli-linux-arm64 was designed to appear as a legitimate platform-specific optional dependency shim, making it more likely to be installed without scrutiny. The incident was identified by Amazon Inspector and credited to the OpenSSF malicious packages project.