MalwarePublished 5 Aug 2026Updated 7 Aug 2026

sextant-cli-darwin-arm64 (npm) · Malicious Code

Affects sextant-cli-darwin-arm64Source GCVE Database

Malicious package : remove sextant-cli-darwin-arm64 and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 15:17 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-11997

What to do

Remove sextant-cli-darwin-arm64 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmsextant-cli-darwin-arm64	Affected 0.0.1-rc5 – 0.0.1-rc37 32 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (23978b08a7e3f8af97d2c8060e7fc3aca9a18d9f3435163a9d3ab97ac0b9d4d0) Package ships a darwin/arm64 Go binary that opens an outbound WebSocket to a hardcoded author-controlled relay at wss://relay.sextant.top and links a PTY library (github.com/creack/pty) with a WebSocket client (github.com/coder/websocket), implementing the network-driven pseudo-terminal remote-shell pattern that yields full-host code execution to the operator of that relay. The binary additionally binds listeners on 0.0.0.0:7280, 0.0.0.0:7281, and 0.0.0.0:9000 (a 'ws://%s:%s%s' format string is present), exposing the PTY/WebSocket surface to the local network rather than loopback. Embedded strings include a regex specifically matching Anthropic API keys ('sk-ant-[a-z0-9]+-[A-Za-z0-9_-]{40,}') and references to CLAUDE_CONFIG_DIR and ~/.claude paths, allowing extraction of the installer's Anthropic credentials, which are then reachable via the same relay channel. A separate POST to https://relay.sextant.top/install combined with a call to http://ip-api.com/json/?fields=status,message,country,countryCode,city,timezone,query reports installer geolocation and host identity to the author. The npm-facing metadata describes the package only as 'Sextant (sxt) binary for darwin/arm64', while the license field points to a GitHub repository named 'claude_control' — the shipped functionality (remote control of Claude Code / Gemini CLI sessions plus API-key exfiltration) is not disclosed in the package description or README.

Impact

Successful installation and execution of this package results in full remote code execution on the affected host via a WebSocket-based remote shell controlled by the attacker. Sensitive credentials, specifically Anthropic API keys and configuration data, are extracted and exfiltrated to the attacker. The attacker's relay also receives geolocation and host identity information, potentially aiding further targeted attacks or reconnaissance. The exposure of the remote shell interface on local network interfaces increases the attack surface by allowing other devices on the local network to connect to the malicious service.

Defensive guidance

Users should immediately uninstall the affected versions of sextant-cli-darwin-arm64 and avoid installing this package. Since the malicious code is embedded in the binary, replacing the package with a clean, verified version (if available) or an alternative tool is recommended. Monitor for any unauthorized network connections to wss://relay.sextant.top or local ports 7280, 7281, and 9000. Review and rotate any potentially compromised Anthropic API keys and related credentials.

Summary

The sextant-cli-darwin-arm64 npm package includes a malicious Go binary that opens an outbound WebSocket to a hardcoded attacker-controlled relay (wss://relay.sextant.top). This relay enables a network-driven pseudo-terminal remote shell, granting the attacker full code execution on the host. The binary also binds listeners on multiple local network ports (7280, 7281, 9000), exposing the remote shell interface beyond localhost. Embedded regex patterns target Anthropic API keys for extraction, and the binary exfiltrates these credentials along with installer geolocation and host identity data via HTTP POST requests to the relay and an IP geolocation service. The npm package description and README omit any mention of these malicious behaviors, misleading users about its true functionality.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 18:39 UTC

Technical details

References

Community reviews