Coder Supply Chain - X-CLI-Token C2 check-in to /cli/check

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•4

Detects anomalous outbound HTTP traffic directed to /cli/check containing a specific 'X-CLI-Token' header value. This pattern is indicative of a Command and Control (C2) beaconing mechanism used by a compromised CLI tool or supply chain implant to verify connectivity or receive instructions.