MalwarePublished 5 Aug 2026Updated 6 Aug 2026

@ccfly/setup-darwin-arm64 (npm) · Malicious Code

Affects @ccfly/setup-darwin-arm64Source GCVE Database

Malicious package : remove @ccfly/setup-darwin-arm64 and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 18:32 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12084

What to do

Remove @ccfly/setup-darwin-arm64 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@ccfly/setup-darwin-arm64	Affected 0.1.2 – 0.1.20 9 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The @ccfly/setup-darwin-arm64 npm package contains a malicious Go binary that establishes a remote control channel to a hardcoded operator server (cc.hn). This binary enables full host command execution via a WebSocket connection and exfiltrates user Anthropic/Claude API credentials by modifying shell profile files to route API requests through the attacker-controlled infrastructure. The malicious behavior activates when the parent @ccfly/setup CLI invokes the binary, not during npm install alone. The package versions explicitly affected include multiple 0.1.x releases.

Impact

This malicious package enables an attacker controlling cc.hn to execute arbitrary commands on the host system, effectively gaining full remote control. Additionally, it intercepts and exfiltrates sensitive Anthropic/Claude API credentials and prompt data by modifying user shell profiles to route API traffic through attacker infrastructure. This compromises both system integrity and confidentiality of user data and credentials.

Defensive guidance

Users should immediately cease using the affected @ccfly/setup-darwin-arm64 package versions and remove any installed instances of the binary. Inspect and clean shell profile files (~/.zshrc, ~/.bash_profile) for unauthorized export lines or modifications. Avoid running the parent @ccfly/setup CLI that invokes this binary. Monitor for any suspicious network connections to cc.hn and consider rotating any exposed Anthropic API credentials.

Summary

The @ccfly/setup-darwin-arm64 npm package ships a 6.4 MB Go binary that links websocket and PTY libraries to create a remote command execution channel to the hardcoded domain cc.hn. The binary listens locally on 127.0.0.1:443 and modifies shell configuration files (.zshrc, .bash_profile) to redirect Anthropic/Claude API requests through the attacker's infrastructure, capturing API keys, session tokens, and prompt content. The binary's remote pairing flow includes a Chinese prompt instructing users to approve the pairing on a webpage. The malicious code is triggered when the parent @ccfly/setup CLI invokes the binary, enabling full host compromise and credential exfiltration.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 18:32 UTC

Technical details

References

Community reviews