Malicious code in sextant-cli-darwin-amd64 (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9d2e5ab6503eb2b9c12bf64e34cb2fe12227c07b179231ebe23f13b8866181f1) The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main, no bin mapping, and no scripts — the package is a platform-artifact shipped for consumption as an optionalDependency by a parent sextant-cli. Strings extracted from bin/sxt show it embeds github.com/coder/websocket and github.com/creack/pty together with the hardcoded relay URL wss://relay.sextant.top; that network-to-PTY dataflow is a remote-shell backdoor driven by an attacker-controlled WebSocket relay on the installer's host. The same binary contains the Anthropic API-key regex sk-ant-[a-z0-9]+-[A-Za-z0-9_-]{40,} alongside CLAUDE_CONFIG_DIR=, https://claude.ai/, and https://api.anthropic.com/v1/models, indicating the binary reads the installer's Claude configuration directory and fingerprints sk-ant-* credentials for exfiltration through the same relay. Additional strings embed http://ip-api.com/json/?fields=status,message,country,countryCode,city,timezone,isp,org,as,proxy,hosting,mobile,query, profiling the installer's public IP, city, ISP, org, ASN, and hosting/proxy flags. package.json declares its license as SEE LICENSE IN https://github.com/ddos798/claude_control, and the binary references https://claude.ai/install.sh and https://registry.npmjs.org/sextant-cli/latest for self-update. Delivering behavior only as a stripped compiled binary conceals the network-to-PTY, credential-regex, and geolocation logic from JS-level inspection.
AI Analysis
Technical Summary
The sextant-cli-darwin-amd64 package includes a 13.4 MB Mach-O Go binary that implements a remote shell backdoor by relaying network data to a pseudo-terminal via a WebSocket connection to wss://relay.sextant.top. The binary embeds libraries for WebSocket and PTY handling and contains logic to locate and exfiltrate Anthropic Claude API keys (matching the regex sk-ant-[a-z0-9]+-[A-Za-z0-9_-]{40,}) from the installer's Claude configuration directory. It also queries an IP geolocation service (http://ip-api.com) to profile the host's public IP, city, ISP, ASN, and proxy/hosting status. The package.json lacks source code or scripts, indicating the binary is the sole payload. The binary references URLs for self-update and license information, further indicating malicious intent. This behavior is hidden from JavaScript-level inspection due to the binary-only delivery.
Potential Impact
This malicious package enables attackers to gain remote shell access on affected hosts, allowing arbitrary command execution. It also steals sensitive Anthropic Claude API credentials from the user's environment, potentially compromising access to AI services. The collection of geolocation and ISP data facilitates profiling of victims. The backdoor and credential theft pose significant confidentiality and integrity risks to affected systems and user data.
Mitigation Recommendations
No official patch or remediation is currently available. Users should immediately uninstall all affected versions of sextant-cli-darwin-amd64 (listed below) and avoid installing this package. Since the malicious behavior is embedded in a compiled binary, standard JavaScript code reviews will not detect it. Monitor for network connections to wss://relay.sextant.top and related suspicious activity. Check for presence of the binary 'bin/sxt' in the package installation directory and remove if found. Consider rotating any exposed Anthropic Claude API keys. Stay updated with vendor or npm advisories for any future fixes or guidance.
Malicious code in sextant-cli-darwin-amd64 (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9d2e5ab6503eb2b9c12bf64e34cb2fe12227c07b179231ebe23f13b8866181f1) The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main, no bin mapping, and no scripts — the package is a platform-artifact shipped for consumption as an optionalDependency by a parent sextant-cli. Strings extracted from bin/sxt show it embeds github.com/coder/websocket and github.com/creack/pty together with the hardcoded relay URL wss://relay.sextant.top; that network-to-PTY dataflow is a remote-shell backdoor driven by an attacker-controlled WebSocket relay on the installer's host. The same binary contains the Anthropic API-key regex sk-ant-[a-z0-9]+-[A-Za-z0-9_-]{40,} alongside CLAUDE_CONFIG_DIR=, https://claude.ai/, and https://api.anthropic.com/v1/models, indicating the binary reads the installer's Claude configuration directory and fingerprints sk-ant-* credentials for exfiltration through the same relay. Additional strings embed http://ip-api.com/json/?fields=status,message,country,countryCode,city,timezone,isp,org,as,proxy,hosting,mobile,query, profiling the installer's public IP, city, ISP, org, ASN, and hosting/proxy flags. package.json declares its license as SEE LICENSE IN https://github.com/ddos798/claude_control, and the binary references https://claude.ai/install.sh and https://registry.npmjs.org/sextant-cli/latest for self-update. Delivering behavior only as a stripped compiled binary conceals the network-to-PTY, credential-regex, and geolocation logic from JS-level inspection.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The sextant-cli-darwin-amd64 package includes a 13.4 MB Mach-O Go binary that implements a remote shell backdoor by relaying network data to a pseudo-terminal via a WebSocket connection to wss://relay.sextant.top. The binary embeds libraries for WebSocket and PTY handling and contains logic to locate and exfiltrate Anthropic Claude API keys (matching the regex sk-ant-[a-z0-9]+-[A-Za-z0-9_-]{40,}) from the installer's Claude configuration directory. It also queries an IP geolocation service (http://ip-api.com) to profile the host's public IP, city, ISP, ASN, and proxy/hosting status. The package.json lacks source code or scripts, indicating the binary is the sole payload. The binary references URLs for self-update and license information, further indicating malicious intent. This behavior is hidden from JavaScript-level inspection due to the binary-only delivery.
Potential Impact
This malicious package enables attackers to gain remote shell access on affected hosts, allowing arbitrary command execution. It also steals sensitive Anthropic Claude API credentials from the user's environment, potentially compromising access to AI services. The collection of geolocation and ISP data facilitates profiling of victims. The backdoor and credential theft pose significant confidentiality and integrity risks to affected systems and user data.
Mitigation Recommendations
No official patch or remediation is currently available. Users should immediately uninstall all affected versions of sextant-cli-darwin-amd64 (listed below) and avoid installing this package. Since the malicious behavior is embedded in a compiled binary, standard JavaScript code reviews will not detect it. Monitor for network connections to wss://relay.sextant.top and related suspicious activity. Check for presence of the binary 'bin/sxt' in the package installation directory and remove if found. Consider rotating any exposed Anthropic Claude API keys. Stay updated with vendor or npm advisories for any future fixes or guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12028
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a735741bf8831d539155f4d
Added to database: 08/05/2026, 15:31:13 UTC
Last enriched: 08/05/2026, 17:02:22 UTC
Last updated: 09/11/2026, 14:27:37 UTC
Views: 19
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.