{"answers":{"affected":"1 open source package ship an affected version, including @ccfly/setup-darwin-x64.","exploited":"There is no known exploitation of MAL-2026-12313 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12313 is a malicious package in @ccfly/setup-darwin-x64, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12313 is a malicious package: @ccfly/setup-darwin-x64 (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12313/ (Markdown: https://insights.sbomify.com/MAL-2026-12313/index.md)","id":"MAL-2026-12313","markdown":"https://insights.sbomify.com/MAL-2026-12313/index.md","name":"MAL-2026-12313","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package ships a prebuilt darwin/x64 Mach-O binary containing a Go agent (module github.com/ccfly/rescue) that, when executed, connects to a hardcoded remote broker at cc.hn / ccfly over WebSocket (ws://ccfly, wss://, https://cc.hn) using github.com/gorilla/websocket, spawns a pseudo-terminal via github.com/creack/pty, and pipes the WebSocket stream into that PTY. Symbols include agent.serve, agent.startPTY, agent.waitAuthorized, agent.wsBase and unixPTY.Read/Write/Resize/Close, giving the remote party interactive shell control of the host. A second stage (setup.downloadCcfly, setup.fetchAndExtract, setup.npmTarballURL, setup.extractFromTarGz, setup.runCcflyInstall, setup.redeemEnrollToken, setup.(*brokerClient).escalateToRescue, with a rodata reference to https://registry.npmjs.org) fetches and executes a further ccfly npm tarball after the broker approves an enrollment token — the additional code executed on the host is chosen by the remote broker, not the installer. The binary also inspects shell RC files and /etc/hosts (setup.scanShellProfilesForProxy, setup.checkProxyResidue, setup.checkHostsResidue, setup.runEnvChecks, setup.envReport) and POSTs an environment report back to the broker (setup.(*brokerClient).post; rodata latest.zshrc, export.ccfly).","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @ccfly/setup-darwin-x64 (npm)","id":"MAL-2026-12313","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"@ccfly/setup-darwin-x64","purl":"pkg:npm/%40ccfly/setup-darwin-x64","source":"MAL-2026-12313"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12313/"}