MAL-2026-12029 Malicious code in sextant-cli-linux-amd64 (npm)

sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay at wss://relay.sextant.top and exposes a local interactive shell to a remote controller. The binary uses creack/pty and exec.Command to spawn /bin/bash, /bin/sh, or /bin/zsh under a PTY and forwards stdio through WebRTC data channels, giving a remote party on the sextant.top relay a full interactive shell on the installer's host. The binary also contacts http://ip-api.com/json/ over cleartext HTTP to collect the host's public IP and geolocation and reports it back through the same control channel. Embedded strings referencing /etc/systemd and 'sextantsystemdbootoutdefault.claudekey' indicate a subcommand that installs the agent as a systemd unit for boot persistence. package.json's license URL points to https://github.com/ddos798/claude_control, and the binary internally references 'claude_control' and api.anthropic.com, consistent with a tool designed to remotely pilot the installer's host and Claude Code sessions. Regardless of the tool's advertised purpose, a network-sourced controller driving a PTY on the installer's machine, with systemd persistence support and host reconnaissance to a third-party geolocation service, constitutes a persistent remote backdoor into the installer host.