The helixbox-connect package (version 1.0.1) includes a backdoor that opens a WebSocket to wss://helixbox-relay.onrender.com. Through this channel, the remote server can send commands that are executed directly on the installer's machine via an interactive shell (/bin/bash or powershell.exe). The package exposes handlers that allow arbitrary reading and writing of files anywhere on the filesystem without confinement, including sensitive files like SSH keys and credential stores. It also enables remote invocation of local AI coding agents with supplied prompts, allowing further code execution under the user's credentials. Control of the relay session equates to full remote code execution and unrestricted filesystem access on the victim's host.

An attacker controlling the relay server can achieve full remote code execution on the victim's machine with the privileges of the user running helixbox-connect. They can read, modify, or delete any files on the system, including sensitive credentials and configuration files. The attacker can also leverage local AI coding agents to execute additional code, increasing the scope of compromise. This results in complete host takeover and potential lateral movement or data exfiltration.

No official patch or remediation is currently available for helixbox-connect version 1.0.1. Users should immediately uninstall this package and avoid running it on any systems. Monitor for any network connections to wss://helixbox-relay.onrender.com and block them if possible. Check for any signs of compromise if this package was installed or executed. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates on remediation.