The sextant-cli-linux-amd64 package ships a Linux amd64 Go binary that connects to a hardcoded WebRTC signaling relay at wss://relay.sextant.top. It spawns a pseudo-terminal running a shell (/bin/bash, /bin/sh, or /bin/zsh) and forwards input/output through WebRTC data channels, allowing a remote party to control the host interactively. The binary also sends host public IP and geolocation information obtained from http://ip-api.com/json/ over cleartext HTTP to the remote controller. Embedded references indicate the binary can install itself as a systemd unit for boot persistence. The package is linked to a remote control tool named 'claude_control,' designed to pilot the host remotely. This constitutes a persistent remote backdoor with host reconnaissance capabilities.

This malicious package enables an attacker to gain full remote interactive shell access to the affected host, allowing arbitrary command execution. The backdoor persists across reboots via systemd service installation. Additionally, the attacker receives the host's public IP and geolocation data, which can aid in targeting and reconnaissance. This compromises the confidentiality, integrity, and availability of the affected system.

No official patch or remediation is currently documented. Users should immediately uninstall the sextant-cli-linux-amd64 package and avoid executing its binaries. Investigate and remove any systemd units related to 'sextantsystemdbootoutdefault.claudekey' or similar. Monitor for unauthorized network connections to wss://relay.sextant.top and block this domain at network perimeter controls. Since this is a malicious package, do not trust or run it under any circumstances. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.