MalwarePublished 5 Aug 2026Updated 7 Aug 2026

sextant-cli-darwin-amd64 (npm) · Malicious Code

Affects sextant-cli-darwin-amd64Source GCVE Database

Malicious package : remove sextant-cli-darwin-amd64 and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 15:17 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12028

What to do

Remove sextant-cli-darwin-amd64 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmsextant-cli-darwin-amd64	Affected 0.0.1-rc5 – 0.0.1-rc36 32 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9d2e5ab6503eb2b9c12bf64e34cb2fe12227c07b179231ebe23f13b8866181f1) The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main, no bin mapping, and no scripts — the package is a platform-artifact shipped for consumption as an optionalDependency by a parent sextant-cli. Strings extracted from bin/sxt show it embeds github.com/coder/websocket and github.com/creack/pty together with the hardcoded relay URL wss://relay.sextant.top; that network-to-PTY dataflow is a remote-shell backdoor driven by an attacker-controlled WebSocket relay on the installer's host. The same binary contains the Anthropic API-key regex sk-ant-[a-z0-9]+-[A-Za-z0-9_-]{40,} alongside CLAUDE_CONFIG_DIR=, https://claude.ai/, and https://api.anthropic.com/v1/models, indicating the binary reads the installer's Claude configuration directory and fingerprints sk-ant-* credentials for exfiltration through the same relay. Additional strings embed http://ip-api.com/json/?fields=status,message,country,countryCode,city,timezone,isp,org,as,proxy,hosting,mobile,query, profiling the installer's public IP, city, ISP, org, ASN, and hosting/proxy flags. package.json declares its license as SEE LICENSE IN https://github.com/ddos798/claude_control, and the binary references https://claude.ai/install.sh and https://registry.npmjs.org/sextant-cli/latest for self-update. Delivering behavior only as a stripped compiled binary conceals the network-to-PTY, credential-regex, and geolocation logic from JS-level inspection.

Impact

This malicious package enables attackers to gain remote shell access on affected hosts, allowing arbitrary command execution. It also steals sensitive Anthropic Claude API credentials from the user's environment, potentially compromising access to AI services. The collection of geolocation and ISP data facilitates profiling of victims. The backdoor and credential theft pose significant confidentiality and integrity risks to affected systems and user data.

Defensive guidance

Users should immediately uninstall all affected versions of sextant-cli-darwin-amd64 (listed below) and avoid installing this package. Since the malicious behavior is embedded in a compiled binary, standard JavaScript code reviews will not detect it. Monitor for network connections to wss://relay.sextant.top and related suspicious activity. Check for presence of the binary 'bin/sxt' in the package installation directory and remove if found. Consider rotating any exposed Anthropic Claude API keys. Stay updated with vendor or npm advisories for any future fixes or guidance.

Summary

The sextant-cli-darwin-amd64 package includes a 13.4 MB Mach-O Go binary that implements a remote shell backdoor by relaying network data to a pseudo-terminal via a WebSocket connection to wss://relay.sextant.top. The binary embeds libraries for WebSocket and PTY handling and contains logic to locate and exfiltrate Anthropic Claude API keys (matching the regex sk-ant-[a-z0-9]+-[A-Za-z0-9_-]{40,}) from the installer's Claude configuration directory. It also queries an IP geolocation service (http://ip-api.com) to profile the host's public IP, city, ISP, ASN, and proxy/hosting status. The package.json lacks source code or scripts, indicating the binary is the sole payload. The binary references URLs for self-update and license information, further indicating malicious intent. This behavior is hidden from JavaScript-level inspection due to the binary-only delivery.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 17:02 UTC

Technical details

References

Community reviews