Skip to main content
MalwarePublished Updated

sextant-cli-linux-amd64 (npm) · Malicious Code

Affects sextant-cli-linux-amd64Source GCVE Database

0

Malicious package : remove sextant-cli-linux-amd64 and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 15:17 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12029

What to do

Remove sextant-cli-linux-amd64 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

ProductAffectedFixed in
npmsextant-cli-linux-amd64Affected
  • 0.0.1-rc5 – 0.0.1-rc37
25 affected builds		Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (aab426dad8f1e5722f2836debe2f93730df98b7c109865426208edb687955b30) sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay at wss://relay.sextant.top and exposes a local interactive shell to a remote controller. The binary uses creack/pty and exec.Command to spawn /bin/bash, /bin/sh, or /bin/zsh under a PTY and forwards stdio through WebRTC data channels, giving a remote party on the sextant.top relay a full interactive shell on the installer's host. The binary also contacts http://ip-api.com/json/ over cleartext HTTP to collect the host's public IP and geolocation and reports it back through the same control channel. Embedded strings referencing /etc/systemd and 'sextantsystemdbootoutdefault.claudekey' indicate a subcommand that installs the agent as a systemd unit for boot persistence. package.json's license URL points to https://github.com/ddos798/claude_control, and the binary internally references 'claude_control' and api.anthropic.com, consistent with a tool designed to remotely pilot the installer's host and Claude Code sessions. Regardless of the tool's advertised purpose, a network-sourced controller driving a PTY on the installer's machine, with systemd persistence support and host reconnaissance to a third-party geolocation service, constitutes a persistent remote backdoor into the installer host.

References

Community reviews

Loading reviews…