# MAL-2026-13418: Malicious code in @ccfly/setup-linux-x64 (npm)


- **Type:** Malicious package
- **Package:** `@ccfly/setup-linux-x64` (npm)
- **Published:** 6 Aug 2026

## What is MAL-2026-13418?

MAL-2026-13418 is a malicious package in @ccfly/setup-linux-x64, published on 6 Aug 2026. 

### Official description

The tarball ships a single 6.9 MB linux/x64 Go executable at bin/ccfly-setup and no source. The binary links github.com/creack/pty (PTY spawning) and github.com/gorilla/websocket (WebSocket client), and contains hardcoded destinations ws://ccflycc.hn, wss://, and https://cc.hn along with strings that drive apt-get/pacman/zypper package installs after a remote 'approve' step (including a Chinese status string meaning 'client installed and paired'). This is a remote-controlled shell/executor architecture: a persistent WebSocket to a vendor-controlled server plus a local PTY and privileged package-manager invocations give whoever controls ccflycc.hn / cc.hn full command execution and privileged package installation on the host running the binary. package.json declares only {os:[linux], cpu:[x64], files:[bin]} with no scripts, main, or bin field, so `npm install` does not by itself execute the binary; the backdoor activates when the companion @ccfly/* wrapper CLI resolves this optionalDependency and invokes bin/ccfly-setup. The delivery uses plain ws:// in addition to wss://, and no source is shipped for independent audit.

## What should I do about MAL-2026-13418?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-13418 is a malicious package: @ccfly/setup-linux-x64 (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-13418/ (Markdown: https://insights.sbomify.com/MAL-2026-13418/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-13418

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-13418/
Summaries are generated and may contain mistakes; the official description above is the record.