GCVE-110-OSM-2026-13378

The OpenSSF Package Analysis project identified 'kafka-helmsman' @ 99.0.1 (pypi) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in setup.py: "urllib.request.Request(" - System Information Collection in setup.py: "socket.gethostname()" ADDITIONAL FINDINGS - Shell Command Execution in setup.py: "subprocess.run(" - Silent Process Execution in setup.py: "stdout=subprocess.DEVNULL" - Brand New Package - Rapid Version Publishing PAYLOAD FILES setup.py