OpenSSF/OSV advisory MAL-2026-12043 confirms this npm version as malicious. The tarball ships a linux/arm64 Go executable (`sxt`) as its sole payload. The binary embeds a PTY-spawning library (github.com/creack/pty) together with a WebSocket client (github.com/coder/websocket) and a full WebRTC stack (github.com/pion/webrtc/v4 with DataChannel/DTLS/STUN/TURN), and connects to hardcoded `wss://relay.sextant.top` (with a companion `https://relay.sextant.top/install` POST)...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in sextant-cli-linux-arm64 (npm)
Details
The tarball ships a linux/arm64 Go executable (`sxt`) as its sole payload. The binary embeds a PTY-spawning library (github.com/creack/pty) together with a WebSocket client (github.com/coder/websocket) and a full WebRTC stack (github.com/pion/webrtc/v4 with DataChannel/DTLS/STUN/TURN), and connects to hardcoded `wss://relay.sextant.top` (with a companion `https://relay.sextant.top/install` POST). Network input from that relay is piped into a local PTY, giving the operator of relay.sextant.top an interactive shell on the installer's host. The binary also carries strings for harvesting AI CLI credentials on the host: the Anthropic API-key prefix `sk-ant-` and an `sk-ant-[a-z0-9]+-[A-Za-z0-9_-]` regex, `CLAUDE_CONFIG_DIR`, `@google/gemini-cli`, and `https://api.anthropic.com/v1/models`, alongside references to `passwd`, `shadow`, `history`, and `HOME`. A hardcoded `http://ip-api.com/json/?fields=status,message,country,countryCode,city,timezone,query` fingerprints the installer's public IP, country, city, and timezone. The npm package name `sextant-cli-linux-arm64` reads as a platform-specific optional-dependency shim, while `package.json` points its license at `https://github.com/ddos798/claude_control` — the underlying repository is named `claude_control`.
Decision reason
OpenSSF Malicious Packages via OSV confirms sextant-cli-linux-arm64@0.0.1-rc25 as malicious (MAL-2026-12043): Malicious code in sextant-cli-linux-arm64 (npm)