{"id":"MAL-2026-17703","kind":"package","aliases":["MAL-2026-17703"],"related":[],"title":"Malicious code in kafka-roller (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4490e03c9b281c985d7cc5c877d359f8f3789a2ec44421602137c461ac4a2a52)\nThe package is published to PyPI under the name kafka-roller with metadata impersonating Tesla's teslamotors/kafka-helmsman project (homepage points at github.com/teslamotors/kafka-helmsman while the publisher is an unaffiliated account), and version 99.0.4 is pinned implausibly high — the dependency-confusion squat shape. setup.py starts a module-level daemon thread during pip's metadata/wheel build that collects hostname, current working directory, platform information, a timestamp and a UUID, and transmits them via HTTPS POST to https://webhook.site/bf5cb178-e0cf-43b6-8b1e-fb5d2f6ea9c9 and via HTTPS GET plus DNS lookups to a subdomain of oast.site (an interactsh out-of-band collector). The DNS channel is driven by subprocess invocations of nslookup/getent/dig against an attacker-chosen hostname, providing a secondary exfiltration path that bypasses HTTP egress filtering. The beacon fires on any pip processing of the sdist without installer consent, and leaks internal host and build-environment identifiers for any build system that misresolves the kafka-roller name to this PyPI package. A self-description as 'dependency-confusion security research' does not change the behavior: install-time out-of-band callbacks carrying host identifiers to attacker-controlled collectors are exfiltration regardless of framing.\n\n## Source: kam193 (ddfe2b638b0889fe0ad773e6d97df2a3649cd830ca5e2ae851a2227ede687b1a)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n## Source: ossf-package-analysis (4b68fa52500e16cab90e8038ae96e2ba1be6c448a8caa40ab3e46dc6d3c26436)\nThe OpenSSF Package Analysis project identified 'kafka-roller' @ 99.0.0 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"kafka-roller","fixed":[],"affected":"= 99.0.0; = 99.0.1; = 99.0.2; = 99.0.3; = 99.0.4; = 99.0.5; = 99.0.6","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-08T20:52:03+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","triaged_at":"2026-10-26T21:08:21+00:00","updated_at":"2026-10-26T21:08:21+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-17703':10A,13A '-2026':9A,12A '/bf5cb178-e0cf-43b6-8b1e-fb5d2f6ea9c9':114C '/teslamotors/kafka-helmsman':58C '4490e03':32C '4b68fa52500e16cab90e8038ae96e2ba1be6c448a8caa40ab3e46dc6d3c26436':336C '99.0.0':346C '99.0.4':68C 'account':65C 'activ':364C 'also':266C 'amazon':30C 'amazon-inspector':29C 'analysi':335C,340C 'anyth':267C 'associ':361C 'attack':147C,225C 'attacker-chosen':146C 'attacker-control':224C 'band':132C,218C 'base':293C 'basic':244C,303C 'beacon':161C 'behavior':211C 'build':91C,179C,184C 'build-environ':178C 'bypass':156C 'c9b281c985d7cc5c877d359f8f3789a2ec44421602137c461ac4a2a52':33C 'callback':219C 'campaign':285C,296C 'carri':220C 'categori':256C 'chang':209C 'channel':136C 'chosen':148C 'clear':280C 'co':278C 'code':2A,300C,328C 'collect':93C 'collector':133C,227C 'command':322C 'communic':357C 'confus':76C,204C 'consent':172C 'consid':352C 'contain':299C 'control':226C 'current':95C 'daemon':85C 'data':304C 'ddfe2b638b0889fe0ad773e6d97df2a3649cd830ca5e2ae851a2227ede687b1a':235C 'depend':75C,203C 'dependency-confus':74C,202C 'descript':200C 'detail':21C 'directori':97C 'dns':120C,135C 'domain':360C 'driven':138C 'edit':24C 'egress':158C 'environ':180C 'execut':326C 'exfiltr':153C,229C,243C,302C 'explor':272C 'filter':159C 'fire':162C 'frame':232C 'generic':287C 'generic-standard-pypi-install-pentest':286C 'get':118C 'github.com':57C 'github.com/teslamotors/kafka-helmsman':56C 'harm':283C 'high':72C 'homepag':53C 'host':176C,221C,248C 'hostnam':94C,149C 'http':157C 'https':109C,117C 'identifi':181C,222C,342C 'imperson':48C 'implaus':71C 'import':240C 'inform':99C,245C 'inspector':31C 'instal':171C,213C,236C,290C,321C,330C 'install-tim':212C 'interactsh':128C 'intern':175C 'invoc':141C 'ip':309C 'kafka':5A,15A,44C,190C,344C 'kafka-rol':4A,43C,189C,343C 'kafka-roller':14A 'kam193':234C 'kit':276C 'leak':174C 'level':84C 'like':261C,270C,308C 'limit':315C 'line':27C 'look':260C,269C 'lookup':121C 'low':282C 'low-harm':281C 'mal':8A,11A 'malici':1A,17B,327C,349C,353C,363C 'metadata':47C 'metadata/wheel':90C 'misresolv':187C 'modul':83C,242C 'module-level':82C 'name':42C,192C 'nslookup/getent/dig':143C 'oast.site':126C 'openssf':338C 'ossf':333C 'ossf-package-analysi':332C 'out-of-band':129C,215C 'overrid':319C 'packag':18B,35C,196C,238C,251C,259C,264C,298C,318C,334C,339C,356C 'path':154C 'pentest':258C,263C,291C 'per':19C 'pin':70C 'pip':88C,165C 'platform':98C 'plus':119C 'point':54C 'possibl':284C 'post':110C 'pre':274C 'pre-prepar':273C 'prepar':275C 'probabl':257C 'process':166C 'project':52C,341C 'provid':150C 'publish':37C,61C 'purpos':255C 'pypi':7A,39C,195C,289C,347C 'reason':292C 'regardless':230C 'research':206C,277C 'risk':316C 'roller':6A,16A,45C,191C,345C 'sdist':169C 'secondari':152C 'secur':205C 'self':199C 'self-descript':198C 'setup.py':79C,324C 'shape':78C 'sourc':20C,28C,233C,331C 'squat':77C 'standard':288C 'start':80C 'subdomain':124C 'subprocess':140C 'system':185C,307C 'tesla':49C 'teslamotors/kafka-helmsman':51C 'test':271C 'thread':86C 'time':214C 'timestamp':101C 'transmit':106C 'typic':262C 'unaffili':64C 'usernam':311C 'uuid':104C 'version':67C 'via':108C,116C 'webhook.site':113C 'webhook.site/bf5cb178-e0cf-43b6-8b1e-fb5d2f6ea9c9':112C 'without':170C 'work':96C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-08T20:52:03+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17703","url":"https://osv.dev/vulnerability/MAL-2026-17703","severity":"critical","published_at":"2026-10-08T20:52:03+00:00","modified_at":"2026-10-09T01:00:09+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","fetched_at":"2026-10-26T20:51:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}