{"id":"MAL-2026-17702","kind":"package","aliases":["MAL-2026-17702"],"related":[],"title":"Malicious code in kafka-helmsman (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (75536e8621da28a0e941bd4a607da879a64ab71214e908992bf14840ed9a20b2)\nThe sdist for kafka-helmsman 99.0.5 is a dependency-confusion placeholder targeting the internal Tesla project name github.com/teslamotors/kafka-helmsman. setup.py contains no build logic; its top-level code starts a daemon thread that collects hostname, current working directory, os.uname output, a timestamp, and a UUID, then POSTs the JSON body to https://webhook.site/bf5cb178-e0cf-43b6-8b1e-fb5d2f6ea9c9 and additionally transmits the same payload to the OAST host jw1yrpkm5xpav.httpcollaborator.com both over HTTPS and via DNS lookups (nslookup/getent/dig) with a base64-url path. Because setup.py executes during pip metadata and wheel build, the beacon fires on any default `pip install kafka-helmsman` and on any resolver that evaluates the sdist. The package declares packages=[] and py_modules=[] and ships no functional kafka tooling, so an installer that mis-resolved the public name instead of the internal one receives only the exfiltration payload. README framing of the artifact as Bugcrowd/Tesla research does not change the behavior: installer-identifying data is sent to hardcoded third-party endpoints controlled by the author.\n\n## Source: kam193 (edc880a17d2b3a9eaeadd0a074e6debc3f507d7afbd4ac8f5c4928209fadbcde)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n## Source: ossf-package-analysis (a2d266a2b4e9df8f2466cfb34e58fe98c636cb75d4ad1ec08cee919bd9a86588)\nThe OpenSSF Package Analysis project identified 'kafka-helmsman' @ 99.0.1 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"kafka-helmsman","fixed":[],"affected":"= 99.0.1; = 99.0.2; = 99.0.3; = 99.0.4; = 99.0.5; = 99.0.6","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-08T21:15:56+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","triaged_at":"2026-10-26T21:08:21+00:00","updated_at":"2026-10-26T21:08:21+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-17702':10A,13A '-2026':9A,12A '/bf5cb178-e0cf-43b6-8b1e-fb5d2f6ea9c9':91C '/teslamotors/kafka-helmsman.':55C '75536e8621':32C '99.0.1':320C '99.0.5':40C 'a2d266a2b4e9df8f2466cfb34e58fe98c636cb75d4ad1ec08cee919bd9a86588':310C 'activ':338C 'addit':93C 'also':240C 'amazon':30C 'amazon-inspector':29C 'analysi':309C,314C 'anyth':241C 'artifact':182C 'associ':335C 'author':206C 'base':267C 'base64':114C 'base64-url':113C 'basic':218C,277C 'beacon':127C 'behavior':190C 'bodi':87C 'bugcrowd/tesla':184C 'build':59C,125C 'campaign':259C,270C 'categori':230C 'chang':188C 'clear':254C 'co':252C 'code':2A,65C,274C,302C 'collect':71C 'command':296C 'communic':331C 'confus':45C 'consid':326C 'contain':57C,273C 'control':203C 'current':73C 'da28a0e941bd4a607da879a64ab71214e908992bf14840ed9a20b2':33C 'daemon':68C 'data':194C,278C 'declar':147C 'default':131C 'depend':44C 'dependency-confus':43C 'detail':21C 'directori':75C 'dns':108C 'domain':334C 'edc880a17d2b3a9eaeadd0a074e6debc3f507d7afbd4ac8f5c4928209fadbcde':209C 'edit':24C 'endpoint':202C 'evalu':142C 'execut':119C,300C 'exfiltr':176C,217C,276C 'explor':246C 'fire':128C 'frame':179C 'function':155C 'generic':261C 'generic-standard-pypi-install-pentest':260C 'github.com':54C 'github.com/teslamotors/kafka-helmsman.':53C 'hardcod':198C 'harm':257C 'helmsman':6A,16A,39C,136C,319C 'host':101C,222C 'hostnam':72C 'https':105C 'identifi':193C,316C 'import':214C 'inform':219C 'inspector':31C 'instal':133C,160C,192C,210C,264C,295C,304C 'installer-identifi':191C 'instead':168C 'intern':49C,171C 'ip':283C 'json':86C 'jw1yrpkm5xpav.httpcollaborator.com':102C 'kafka':5A,15A,38C,135C,156C,318C 'kafka-helmsman':4A,14A,37C,134C,317C 'kam193':208C 'kit':250C 'level':64C 'like':235C,244C,282C 'limit':289C 'line':27C 'logic':60C 'look':234C,243C 'lookup':109C 'low':256C 'low-harm':255C 'mal':8A,11A 'malici':1A,17B,301C,323C,327C,337C 'metadata':122C 'mis':163C 'mis-resolv':162C 'modul':151C,216C 'name':52C,167C 'nslookup/getent/dig':110C 'oast':100C 'one':172C 'openssf':312C 'os.uname':76C 'ossf':307C 'ossf-package-analysi':306C 'output':77C 'overrid':293C 'packag':18B,146C,148C,212C,225C,233C,238C,272C,292C,308C,313C,330C 'parti':201C 'path':116C 'payload':97C,177C 'pentest':232C,237C,265C 'per':19C 'pip':121C,132C 'placehold':46C 'possibl':258C 'post':84C 'pre':248C 'pre-prepar':247C 'prepar':249C 'probabl':231C 'project':51C,315C 'public':166C 'purpos':229C 'py':150C 'pypi':7A,263C,321C 'readm':178C 'reason':266C 'receiv':173C 'research':185C,251C 'resolv':140C,164C 'risk':290C 'sdist':35C,144C 'sent':196C 'setup.py':56C,118C,298C 'ship':153C 'sourc':20C,28C,207C,305C 'standard':262C 'start':66C 'system':281C 'target':47C 'tesla':50C 'test':245C 'third':200C 'third-parti':199C 'thread':69C 'timestamp':79C 'tool':157C 'top':63C 'top-level':62C 'transmit':94C 'typic':236C 'url':115C 'usernam':285C 'uuid':82C 'via':107C 'webhook.site':90C 'webhook.site/bf5cb178-e0cf-43b6-8b1e-fb5d2f6ea9c9':89C 'wheel':124C 'work':74C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-08T21:15:56+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17702","url":"https://osv.dev/vulnerability/MAL-2026-17702","severity":"critical","published_at":"2026-10-08T21:15:56+00:00","modified_at":"2026-10-09T01:00:08+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","fetched_at":"2026-10-26T20:51:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}