kafka-helmsman@99.0.6

Summary

setup.py starts a background thread at module scope before setuptools.setup() that collects the installer's hostname, current working directory, platform string, timestamp, and a UUID, and transmits them via HTTPS POST to https://webhook.site/bf5cb178-e0cf-43b6-8b1e-fb5d2f6ea9c9, HTTPS GET to the Interactsh out-of-band collector db406bsjk35u3jr3048079ybbkxwj7e9f.oast.site, and DNS lookups to the same OAST host. The behavior fires unconditionally on pip build/install. The package ships no functional code (packages=[], py_modules=[]) and claims the name 'kafka-helmsman' at version 99.0.3 — a shape consistent with dependency-confusion resolution against an unpublished internal name referencing github.com/teslamotors/kafka-helmsman, so any internal build referencing this name will prefer this PyPI release and execute the beacon. The package self-describes as 'Bugcrowd security research', but the destinations (webhook.site and *.oast.site) are generic third-party out-of-band collectors not operated by the claimed Tesla project, and the installer did not opt in to the exfiltration.

Source: amazon-inspector (d2d1d7c99040594bd5c9bb0f23a58703e1fa5f1cd15cafbe2abb3e04aa3667be)