OpenSSF/OSV advisory MAL-2026-12029 confirms this npm version as malicious. The npm package ships a Go binary (`sxt`) that on execution registers with the hardcoded C2 host `relay.sextant.top`, establishes WebRTC (pion) DataChannels and APNS push, and drives a local PTY on `/bin/sh` / `/bin/bash` (via `pty.StartWithSize` + `exec.Command`) using bytes delivered over those network channels — a full remote shell on the installer's host controlled by whoever operates the relay...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in sextant-cli-linux-amd64 (npm)
Details
The npm package ships a Go binary (`sxt`) that on execution registers with the hardcoded C2 host `relay.sextant.top`, establishes WebRTC (pion) DataChannels and APNS push, and drives a local PTY on `/bin/sh` / `/bin/bash` (via `pty.StartWithSize` + `exec.Command`) using bytes delivered over those network channels — a full remote shell on the installer's host controlled by whoever operates the relay. The binary additionally fetches `https://claude.ai/install.sh` and queries `https://registry.npmjs.org/sextant-cli/latest` at runtime, giving the operator a fetch-and-exec code-delivery channel and a self-update path independent of the pinned installed version, and references `systemd` and `/tmp/sxt-` paths for persistence. Host geolocation is read from `http://ip-api.com/json/` and `CLAUDE_CODE` / `CLAUDE_` / Anthropic-related environment variables are collected and transmitted to `relay.sextant.top` over Authorization-bearing HTTP and WebRTC, exfiltrating host identifiers and Anthropic credential material to the hardcoded author endpoint. The `package.json` `license` field points at `https://github.com/ddos798/claude_control`, a publisher-supplied reference whose repository name matches the observed remote-control behavior.
Decision reason
OpenSSF Malicious Packages via OSV confirms sextant-cli-linux-amd64@0.0.1-rc16 as malicious (MAL-2026-12029): Malicious code in sextant-cli-linux-amd64 (npm)