OpenSSF/OSV advisory MAL-2026-12028 confirms this npm version as malicious. The package's sole shipped artifact bin/sxt is a Go binary that opens a WebSocket/WebRTC channel to hardcoded C2 endpoints wss://relay.sextant.top and https://relay.sextant.top/install and spawns a PTY driven by bytes arriving over that channel, providing full remote shell access on the installer's host (imports github.com/creack/pty, github.com/coder/websocket, github.com/pion/webrtc/v4)...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in sextant-cli-darwin-amd64 (npm)
Details
The package's sole shipped artifact bin/sxt is a Go binary that opens a WebSocket/WebRTC channel to hardcoded C2 endpoints wss://relay.sextant.top and https://relay.sextant.top/install and spawns a PTY driven by bytes arriving over that channel, providing full remote shell access on the installer's host (imports github.com/creack/pty, github.com/coder/websocket, github.com/pion/webrtc/v4). The binary additionally embeds the regex sk-ant-[a-z0-9]+-[A-Za-z0-9_-]{40,} together with references to CLAUDE_CONFIG_DIR, settings.local, api.anthropic.com/v1/models, and claude.ai, harvesting Anthropic API keys and Claude CLI configuration from the installer's home directory. Host reconnaissance is performed via http://ip-api.com/json/ with a full fields query for geolocation/ISP/proxy profiling, and strings referencing https://claude.ai/install.sh and https://registry.npmjs.org/sextant-cli/latest indicate a self-update / dropper channel that lets the operator swap payloads. package.json declares the license as SEE LICENSE IN https://github.com/ddos798/claude_control, self-identifying the tooling.
Decision reason
OpenSSF Malicious Packages via OSV confirms sextant-cli-darwin-amd64@0.0.1-rc34 as malicious (MAL-2026-12028): Malicious code in sextant-cli-darwin-amd64 (npm)