{"id":"MAL-2026-12793","summary":"Malicious code in helixbox-connect (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (45774464be73a3ba586a4eb9af5a89b3f2439a4f49a80c0b69eb4668cfcf7f89)\nThe `helixbox-connect` bin opens a WebSocket to the hardcoded relay `wss://helixbox-relay.onrender.com` and dispatches messages from the peer into local execution primitives on the installer's host. A `terminal.input` handler forwards peer-supplied bytes directly into the stdin of a spawned interactive shell (`/bin/bash -i` on Unix, `powershell.exe` on Windows), giving the remote party full command execution under the running user. `fs.read`/`fs.write`/`fs.ls`/`fs.stat` handlers accept absolute paths from the peer without confinement (resolvePath returns the path as-is; an in-source comment states the app can browse and edit anywhere on the machine), enabling arbitrary read and overwrite of files including SSH keys, shell RCs, and credential stores. An `ai.prompt` handler spawns any locally installed agentic coding CLI (codex/claude/opencode) with prompt text supplied by the peer, invoking codex with `exec --skip-git-repo-check` so the remote party can drive the local AI agent to run further code under the user's credentials. dist/plain/agent.js issues POST/fetch to `https://helixbox-relay.onrender.com` for session control. Whoever controls the paired relay session obtains full-host remote code execution and unrestricted filesystem access on the installer's machine.\n","modified":"2026-08-05T14:37:14.027381625Z","published":"2026-08-05T13:19:41Z","database_specific":{"malicious-packages-origins":[{"sha256":"45774464be73a3ba586a4eb9af5a89b3f2439a4f49a80c0b69eb4668cfcf7f89","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-014975","import_time":"2026-08-05T14:19:48.446710723Z","modified_time":"2026-08-05T13:19:41Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/helixbox-connect/v/1.0.1"}],"affected":[{"package":{"name":"helixbox-connect","ecosystem":"npm","purl":"pkg:npm/helixbox-connect"},"versions":["1.0.1"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"821c2557b422cbe5c2ab9e0c01f1834d7912b457d008acef1b8fafc28d5b05cb","tlsh":"8c41b90835bb5e7602fbe0a51f77a0422736901735c5dd48beac86909f6c83552e2bf4","path":"dist/plain/terminal.js"},{"path":"dist/plain/agent.js","sha256":"a8894a5a9ecb8646053e91b4f80a5a6ff6422baaec853481b09637b104df5022","tlsh":"4d624f741cf365207633d15d5baba8017129b80b3948cae4badcb224dfdd4b491d6bf8"},{"path":"dist/plain/ai.js","sha256":"c515d6d59dcfc0e2a97cf3230719f49db765a0c63a67c59ab1caca1519431032","tlsh":"d002421c66f725724173b4a93f6b9412673d804b2589cc583ead83a09f5da3482f2ff8"}],"package_integrity":[{"filename":"helixbox-connect-1.0.1.tgz","hashes":{"sha1":"108f93764cf4565ee2ee5d35dadeb3c7735824a5","sha512_sri":"sha512-avI4gVcHrUb7aEJ7vFnO8IvdiUqytOqmPzYbZ3qdxNVKqWDFkdWpZaOqcUSGNzEAyUQA/A9/tCuZEEJScqtoCw=="}}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/helixbox-connect/MAL-2026-12793.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}