@ccfly/setup (0.1.0) potentially affected by unknown CVE via @ccfly/setup-linux-arm64 (0.1.0)

@ccfly/setup-linux-arm64 NPM version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-arm64 and may be impacted: - @ccfly/setup 0.1.0 Source cves: unknown CVE Source advisory: GHSA-68FQ-2X3M-XH9H...

Malicious code in @ccfly/setup-linux-arm64 (npm)

Source: amazon-inspector faefd7405c377b2260ca4d731c9234a294d8d07b559646b8fc58be5488906eec The package ships a 6.3 MB linux/arm64 Go binary at bin/ccfly-setup. The binary embeds github.com/creack/pty PTY spawner and github.com/gorilla/websocket alongside internal packages...

@ccfly/setup (0.1.0) potentially affected by unknown CVE via @ccfly/setup-linux-arm64 (0.1.0)

@ccfly/setup-linux-arm64 NPM version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-arm64 and may be impacted: - @ccfly/setup 0.1.0 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13417...