The @ccfly/setup-linux-x64 npm package contains a malicious Linux/x64 Go binary that acts as a remote-controlled shell and executor. The binary establishes persistent WebSocket connections to attacker-controlled servers and can execute privileged package manager commands after receiving remote approval. The package does not execute the binary on npm install by itself; activation requires a companion @ccfly wrapper CLI that invokes the binary. No source code is provided for audit, and the binary includes hardcoded command-and-control endpoints. Multiple versions of the package are affected.