{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "bin/ccfly-setup",
              "sha256": "ea8bc508e37f5894b1e5405cd286b0e178cdbbbd0d6595ef2e76a2c3d91a5da8",
              "tlsh": "bf566b5abc1e3562d6c976352f6212957238bc4c5f82c7136a18bb3cbef27588f13261"
            },
            {
              "path": "package.json",
              "sha256": "bdb35694b03222a2dbd278edbede80ec5e8ec2d6345090eee462170607a02cb6",
              "tlsh": "a3d02b104a0a403314d8e7e05d25638dad100dd70190b48886afb10d511c7611bf69f9"
            }
          ],
          "package_integrity": [
            {
              "filename": "setup-linux-arm64-0.1.0.tgz",
              "hashes": {
                "sha1": "506665480ae5e47ec1494192b624be31c50e3b32",
                "sha512_sri": "sha512-fO1Bqckd7/eZ/bR23N72X2F0+08N5800xaVh8PKs6GNaKES28IAPSOxGNpQkHWWcmS5zD9u0VXDJ22HLiaNqWg=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@ccfly/setup-linux-arm64"
      },
      "versions": [
        "0.1.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-016524",
        "import_time": "2026-08-06T14:19:53.619982226Z",
        "modified_time": "2026-08-06T13:51:36Z",
        "sha256": "faefd7405c377b2260ca4d731c9234a294d8d07b559646b8fc58be5488906eec",
        "source": "amazon-inspector",
        "versions": [
          "0.1.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (faefd7405c377b2260ca4d731c9234a294d8d07b559646b8fc58be5488906eec)\nThe package ships a 6.3 MB linux/arm64 Go binary at bin/ccfly-setup. The binary embeds github.com/creack/pty (PTY spawner) and github.com/gorilla/websocket alongside internal packages github.com/ccfly/rescue/internal/{agent,setup,proto}, and contains hardcoded remote endpoints ws://ccflycc.hn, wss://\u2026, https://cc.hn, and latest.ccfly, together with strings such as \u0027approveccfly-*install\u0027 and \u0027\u5ba2\u6237\u7aef\u5df2\u5b89\u88c5\u5e76\u914d\u5bf9\u0027 (\u0027client installed and paired\u0027). The binary dials the hardcoded ccfly server over WebSocket and bridges the connection to a locally spawned PTY, giving the remote endpoint an interactive shell on the host that runs it \u2014 a persistent remote-access channel controlled by whoever operates ccfly.hn. package.json declares os:linux, cpu:arm64, files:[\u0027bin\u0027], and no scripts or bin map, so this sub-package alone is not auto-executed on npm install; it is a platform-optional payload intended to be resolved as an optionalDependency of a parent @ccfly/* wrapper, which then invokes bin/ccfly-setup and activates the remote-PTY channel on the installer\u0027s machine.\n",
  "id": "MAL-2026-13417",
  "modified": "2026-08-06T13:51:36Z",
  "published": "2026-08-06T13:51:36Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@ccfly/setup-linux-arm64/v/0.1.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @ccfly/setup-linux-arm64 (npm)"
}