MAL-2026-13418
Vulnerability from ossf_malicious_packages
Published
2026-08-06 13:51
Modified
2026-08-06 14:21
Summary
Malicious code in @ccfly/setup-linux-x64 (npm)
Details
-= Per source details. Do not edit below this line.=-
Source: amazon-inspector (33138ee17148f975a7c0b34f5d6ee1a4ad082395b87872dc91de0778130b91c8)
The tarball ships a single 6.9 MB linux/x64 Go executable at bin/ccfly-setup and no source. The binary links github.com/creack/pty (PTY spawning) and github.com/gorilla/websocket (WebSocket client), and contains hardcoded destinations ws://ccflycc.hn, wss://, and https://cc.hn along with strings that drive apt-get/pacman/zypper package installs after a remote 'approve' step (including a Chinese status string meaning 'client installed and paired'). This is a remote-controlled shell/executor architecture: a persistent WebSocket to a vendor-controlled server plus a local PTY and privileged package-manager invocations give whoever controls ccflycc.hn / cc.hn full command execution and privileged package installation on the host running the binary. package.json declares only {os:[linux], cpu:[x64], files:[bin]} with no scripts, main, or bin field, so npm install does not by itself execute the binary; the backdoor activates when the companion @ccfly/* wrapper CLI resolves this optionalDependency and invokes bin/ccfly-setup. The delivery uses plain ws:// in addition to wss://, and no source is shipped for independent audit.
CWE
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
Credits
{
"affected": [
{
"database_specific": {
"cwes": [
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
}
],
"indicators": {
"evidence_files": [
{
"path": "bin/ccfly-setup",
"sha256": "fa5f9e252b4b2ca17fe3db33e92b8d96585c86eff4bf6be281fec71077b7b867",
"tlsh": "8a664917fca525e9c0ae913189639513bf727c494b3123d35f90ba283f76bd0aab9740"
},
{
"path": "package.json",
"sha256": "159efe1f2a326113006d6e651bf4185ba825fb3753a12e8a281107779db9a126",
"tlsh": "d8d02b214919813316d8eb905c21434d6d100d920190748c8ebf210c512c76159f6af9"
}
],
"package_integrity": [
{
"filename": "setup-linux-x64-0.1.4.tgz",
"hashes": {
"sha1": "c28f6659398e2b0fb13c219319aacb257cb3ca4d",
"sha512_sri": "sha512-01v35tGwt/OWOUAsbgha2mAIA1hGdinx8P1mKo3z0QRkG9rBRd7vNg0u3QzSY+BZF/Bs8p46njBSdPd6Hrrm1g=="
}
}
]
}
},
"package": {
"ecosystem": "npm",
"name": "@ccfly/setup-linux-x64"
},
"versions": [
"0.1.4",
"0.1.3",
"0.1.9",
"0.1.0",
"0.1.1",
"0.1.10",
"0.1.17",
"0.1.19",
"0.1.14",
"0.1.2"
]
}
],
"credits": [
{
"contact": [
"inspector-research@amazon.com"
],
"name": "Amazon Inspector",
"type": "FINDER"
}
],
"database_specific": {
"malicious-packages-origins": [
{
"id": "IN-MAL-2026-016528",
"import_time": "2026-08-06T14:19:53.804217599Z",
"modified_time": "2026-08-06T13:52:11Z",
"sha256": "296e1b146603b0e56bada239257839e6c404720a263d3cf467a727397870f022",
"source": "amazon-inspector",
"versions": [
"0.1.4"
]
},
{
"id": "IN-MAL-2026-016529",
"import_time": "2026-08-06T14:19:53.837368657Z",
"modified_time": "2026-08-06T13:52:24Z",
"sha256": "33138ee17148f975a7c0b34f5d6ee1a4ad082395b87872dc91de0778130b91c8",
"source": "amazon-inspector",
"versions": [
"0.1.3"
]
},
{
"id": "IN-MAL-2026-016526",
"import_time": "2026-08-06T14:19:53.715108564Z",
"modified_time": "2026-08-06T13:51:51Z",
"sha256": "5431775fbfb5393064dfa86e71467919e31bc482ca063b7becb39314dba4ff9f",
"source": "amazon-inspector",
"versions": [
"0.1.9"
]
},
{
"id": "IN-MAL-2026-016525",
"import_time": "2026-08-06T14:19:53.658722047Z",
"modified_time": "2026-08-06T13:51:43Z",
"sha256": "b4d7aa40a791ac6747d32cf63e15018433ac384c673c2587d6d7aa1db2889819",
"source": "amazon-inspector",
"versions": [
"0.1.0"
]
},
{
"id": "IN-MAL-2026-016532",
"import_time": "2026-08-06T14:19:54.026111431Z",
"modified_time": "2026-08-06T13:52:52Z",
"sha256": "ccb15b24f68c411ed5952e93adfb149b226298e8812b32a3293308878d87240c",
"source": "amazon-inspector",
"versions": [
"0.1.1"
]
},
{
"id": "IN-MAL-2026-016533",
"import_time": "2026-08-06T14:19:54.063680206Z",
"modified_time": "2026-08-06T13:53:01Z",
"sha256": "cf67bf381e483cbe273650f4d3af480e113639709c85c6360e7d06388a7b3143",
"source": "amazon-inspector",
"versions": [
"0.1.10"
]
},
{
"id": "IN-MAL-2026-016534",
"import_time": "2026-08-06T14:19:54.104307434Z",
"modified_time": "2026-08-06T13:53:11Z",
"sha256": "5208fc1432f95ef04a90f0cda3cd92b45196ba8e3358ce0ec36b249ef5b95a01",
"source": "amazon-inspector",
"versions": [
"0.1.17"
]
},
{
"id": "IN-MAL-2026-016531",
"import_time": "2026-08-06T14:19:53.964501895Z",
"modified_time": "2026-08-06T13:52:45Z",
"sha256": "82bc092752f32a5ed0564c69bce8ef621d63ab9b89d5a1b74a00710d66bb4ada",
"source": "amazon-inspector",
"versions": [
"0.1.19"
]
},
{
"id": "IN-MAL-2026-016527",
"import_time": "2026-08-06T14:19:53.749459592Z",
"modified_time": "2026-08-06T13:51:59Z",
"sha256": "9632eb35be0c9ea25d90fa7dc0fe9ecd4eaa3b44b0fba5616cb399429d032315",
"source": "amazon-inspector",
"versions": [
"0.1.14"
]
},
{
"id": "IN-MAL-2026-016530",
"import_time": "2026-08-06T14:19:53.876140322Z",
"modified_time": "2026-08-06T13:52:37Z",
"sha256": "c5b8ba92b0192289b9bd7316dcf6fd8964a52fbbbcf50845208501181917800a",
"source": "amazon-inspector",
"versions": [
"0.1.2"
]
}
]
},
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (33138ee17148f975a7c0b34f5d6ee1a4ad082395b87872dc91de0778130b91c8)\nThe tarball ships a single 6.9 MB linux/x64 Go executable at bin/ccfly-setup and no source. The binary links github.com/creack/pty (PTY spawning) and github.com/gorilla/websocket (WebSocket client), and contains hardcoded destinations ws://ccflycc.hn, wss://, and https://cc.hn along with strings that drive apt-get/pacman/zypper package installs after a remote \u0027approve\u0027 step (including a Chinese status string meaning \u0027client installed and paired\u0027). This is a remote-controlled shell/executor architecture: a persistent WebSocket to a vendor-controlled server plus a local PTY and privileged package-manager invocations give whoever controls ccflycc.hn / cc.hn full command execution and privileged package installation on the host running the binary. package.json declares only {os:[linux], cpu:[x64], files:[bin]} with no scripts, main, or bin field, so `npm install` does not by itself execute the binary; the backdoor activates when the companion @ccfly/* wrapper CLI resolves this optionalDependency and invokes bin/ccfly-setup. The delivery uses plain ws:// in addition to wss://, and no source is shipped for independent audit.\n",
"id": "MAL-2026-13418",
"modified": "2026-08-06T14:21:50Z",
"published": "2026-08-06T13:51:43Z",
"references": [
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.4"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.3"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.9"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.0"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.1"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.10"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.17"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.19"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.14"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@ccfly/setup-linux-x64/v/0.1.2"
}
],
"schema_version": "1.7.4",
"summary": "Malicious code in @ccfly/setup-linux-x64 (npm)"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…