The npm package @ccfly/setup-linux-arm64 version 0.1.0 contains a malicious 6.3 MB Go binary targeting Linux ARM64 systems. This binary establishes a persistent remote-access channel by connecting to hardcoded remote endpoints and spawning a local pseudo-terminal (PTY), allowing remote operators interactive shell access on the infected host. The package is designed as an optional dependency and is not auto-executed on install, but a parent @ccfly/* wrapper package may invoke it to activate the backdoor. No official patch or remediation guidance is currently available.