Malicious code in sextant-cli-linux-arm64 (npm)
The npm package sextant-cli-linux-arm64 contained a malicious Linux ARM64 Go binary that establishes a reverse shell to a hardcoded WebSocket relay, harvests AI CLI credentials, and fingerprints the host system. The package was identified by Amazon Inspector and credited to OpenSSF.
- Disclosed
- Last updated
- Blast radius
- Developers and systems installing sextant-cli-linux-arm64 from npm, particularly those on ARM64 Linux systems.
- Ecosystems
- Attack vectors
- Affected entities
- sextant-cli-linux-arm64npm package containing malicious Go binary
The npm package sextant-cli-linux-arm64 was found to contain malicious code in the form of a Linux ARM64 Go executable (sxt). The binary was designed to establish an interactive reverse shell connection to a hardcoded WebSocket relay at wss://relay.sextant.top, allowing remote operators to execute arbitrary commands on infected systems.\n\nThe malicious binary includes multiple capabilities beyond remote shell access. It embeds libraries for PTY spawning (github.com/creack/pty), WebSocket communication (github.com/coder/websocket), and a full WebRTC stack (github.com/pion/webrtc/v4) with DataChannel, DTLS, STUN, and TURN support. The binary also contains hardcoded strings and regex patterns for harvesting AI CLI credentials, specifically targeting Anthropic API keys (prefix sk-ant-) and Google Gemini CLI credentials, along with references to system files like passwd, shadow, and shell history.\n\nAdditional reconnaissance capabilities include IP geolocation fingerprinting via http://ip-api.com/json/, which collects the installer's public IP, country, city, and timezone. The package.json file references a license URL pointing to https://github.com/ddos798/claude_control, indicating the underlying malicious repository.\n\nThe package name sextant-cli-linux-arm64 was designed to appear as a legitimate platform-specific optional dependency shim, making it more likely to be installed without scrutiny. The incident was identified by Amazon Inspector and credited to the OpenSSF malicious packages project.
Indicators of compromise
- Packages
- sextant-cli-linux-arm64
- Domains
- relay.sextant.top
- ip-api.com
Remediation
- Immediately uninstall sextant-cli-linux-arm64 from all systems
- Audit npm package.json and lock files for any installations of sextant-cli-linux-arm64
- Rotate all AI CLI credentials (Anthropic, Google Gemini) that may have been exposed
- Review system logs and network connections for evidence of connections to relay.sextant.top
- Scan systems for the malicious sxt binary and remove any instances
- Monitor for unauthorized shell access or command execution on affected systems
- Review git history and shell history for suspicious activity
- Consider full system reimaging for critical systems that may have been compromised
Sources
- GitHub Advisory GHSA-3w3q-fqgj-f36f · GitHub Advisory Database
Cite this entry
"Malicious code in sextant-cli-linux-arm64 (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-sextant-cli-linux-arm64-npm-17q20e
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in knip-bun
The npm package knip-bun was found to contain malware, resulting in full system compromise for any computer with the package installed or running. All secrets and keys should be rotated immediately from a different computer.
npmCompromised package - activecritical
Malware in requestor-util
Malware discovered in the npm package requestor-util. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in claudechor
Malware was discovered in the npm package claudechor. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmCompromised package - resolvedcritical
Malware in ulebkit
The npm package ulebkit contained malware that provided full system compromise to attackers. Any computer with the package installed or running should be considered fully compromised.
npmCompromised package