GCVE-110-OSM-2026-7947

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. ENTRY pypi/helix-dsl@0.1.1/helix/cli.py (console-script: helix=helix.cli:main) DESTINATION - custom-c2: https://api.ncbi.nlm.nih.gov/datasets/v2alpha (primary, plaintext) in pypi/helix-dsl@0.1.1/helix/databases/ncbi.py - custom-c2: https://eutils.ncbi.nlm.nih.gov/entrez/eutils (plaintext) in pypi/helix-dsl@0.1.1/helix/databases/ncbi.py - custom-c2: https://api.esmatlas.com/foldSequence/v1/pdb/ (plaintext) in pypi/helix-dsl@0.1.1/helix/structure/esmfold.py - custom-c2: api.esmatlas.com (plaintext) in pypi/helix-dsl@0.1.1/helix/structure/esmfold.py - custom-c2: eutils.ncbi.nlm.nih.gov (plaintext) in pypi/helix-dsl@0.1.1/helix/databases/ncbi.py - urls: http://x (c2, plaintext) - domains: api.ncbi.nlm.nih.gov (c2, plaintext) EXFIL - Python File Upload to Remote in pypi/helix-dsl@0.1.1/helix/structure/esmfold.py: "urllib.request.Request(_ESMFOLD_URL, data=" - Network Request in pypi/helix-dsl@0.1.1/helix/databases/ensembl.py: "urllib.request.Request(" - Network Request in pypi/helix-dsl@0.1.1/helix/databases/ncbi.py: "urllib.request.Request(" - Network Request in pypi/helix-dsl@0.1.1/helix/structure/esmfold.py: "urllib.request.Request(" OBFUSCATION - Base64 Encoded Payload in pypi/helix-dsl@0.1.1/helix/agents/demo.py: ""ACCTGCACGTAGCTGCTAGCTAGCTGGCGTACCTGCACGTAGCTGCTAGCTAGCTGGCGTACCTGCACGTAGCTGCTAG..." ADDITIONAL FINDINGS - Shell Command Execution in pypi/helix-dsl@0.1.1/helix/adapters/offtarget.py: "subprocess.run(" PAYLOAD FILES pypi/helix-dsl@0.1.1/helix/structure/esmfold.py INDICATORS (IOCs) - ipv6: 1:: - urls: https://doi.org/10.1038/nbt.3437, https://doi.org/10.1038/nbt.3026, https://rest.ensembl.org, https://grch37.rest.ensembl.org, http://{args.host - domains: doi.org, rest.ensembl.org, grch37.rest.ensembl.org, helix.server.app, errors.pydantic.dev - payloadFileHash: 83d076ce47ba086edf98509e4cda82a5d46177e649a88df963a96c7521eb0e25