MalwarePublished 5 Aug 2026Updated 7 Aug 2026

sextant-cli-linux-arm64 (npm) · Malicious Code

Affects sextant-cli-linux-arm64Source GCVE Database

Malicious package : remove sextant-cli-linux-arm64 and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 15:17 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12043

What to do

Remove sextant-cli-linux-arm64 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmsextant-cli-linux-arm64	Affected 0.0.1-rc5 – 0.0.1-rc36 28 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (fc34f69b5a68c549feccfb32cc2dbfbf2d4c787a4876241027b4299305fd2c53) The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt. The package.json omits repository, author, main, bin, files, and scripts fields, and its license field points at github.com/ddos798/claude_control — a self-labeled 'claude_control' project. Strings in bin/sxt reveal a full WebRTC stack (pion/webrtc/v4, pion/turn/v5, pion/ice/v4, coder/websocket, go-qrcode) plus a hardcoded signaling/relay endpoint https://relay.sextant.top/install, giving the binary the shape of a remote-control agent that pairs the installer's host to an author-controlled peer over WebRTC data channels. Adjacent strings 'sk-ant-', 'CLAUDE_CONFIG_DIR', 'https://api.anthropic.com/v1/models', 'https://claude.ai/install.sh', and '@google/gemini-cli' show the binary is positioned to read Anthropic API keys and Claude Code / Gemini CLI configuration from the installer and hand them to the remote peer through the established channel. An additional string http://ip-api.com/json/ provides public-IP geolocation of the host for the remote operator. The combination of an opaque metadata-only npm manifest, a bundled native binary embedding a full peer-to-peer control stack, a hardcoded author relay, and embedded references to developer AI-credential material is a backdoor with credential-theft capability against the installer.

Impact

The malicious binary enables remote attackers to gain persistent control over the infected host via a peer-to-peer WebRTC channel. It can exfiltrate sensitive AI-related credentials and configuration files, potentially compromising the security and privacy of AI development environments. The collection of public IP geolocation data further aids attacker situational awareness. This can lead to unauthorized access to AI service accounts and potential misuse of those credentials. No known exploits in the wild have been reported yet.

Defensive guidance

Users should avoid installing or using any versions of sextant-cli-linux-arm64 listed as affected. Remove any existing installations of this package and audit systems for the presence of the bin/sxt binary. Monitor for suspicious network connections to the hardcoded relay endpoint (https://relay.sextant.top/install). Consider using trusted sources and verifying package integrity before installation. Check vendor advisories or npm security notices for updates or removal of the malicious package.

Summary

The sextant-cli-linux-arm64 package is a platform-specific npm package for Linux ARM64 that ships a single 12 MB stripped Go binary named bin/sxt. This binary embeds a full WebRTC peer-to-peer communication stack and connects to a hardcoded signaling/relay endpoint (https://relay.sextant.top/install) controlled by the attacker. The binary is capable of remotely controlling the infected host and exfiltrating sensitive AI developer credentials, including Anthropic API keys and Claude/Gemini CLI configurations, by reading local configuration files and sending them over the established WebRTC channel. It also collects public IP geolocation data via http://ip-api.com/json/. The package.json manifest is minimal and lacks typical metadata fields such as repository, author, main, bin, files, and scripts, and its license field points to a suspicious project. This combination of factors indicates a deliberate backdoor with credential theft capabilities embedded in the npm package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 23:18 UTC

Technical details

References

Community reviews