MAL-2026-12793

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (45774464be73a3ba586a4eb9af5a89b3f2439a4f49a80c0b69eb4668cfcf7f89) The `helixbox-connect` bin opens a WebSocket to the hardcoded relay `wss://helixbox-relay.onrender.com` and dispatches messages from the peer into local execution primitives on the installer's host. A `terminal.input` handler forwards peer-supplied bytes directly into the stdin of a spawned interactive shell (`/bin/bash -i` on Unix, `powershell.exe` on Windows), giving the remote party full command execution under the running user. `fs.read`/`fs.write`/`fs.ls`/`fs.stat` handlers accept absolute paths from the peer without confinement (resolvePath returns the path as-is; an in-source comment states the app can browse and edit anywhere on the machine), enabling arbitrary read and overwrite of files including SSH keys, shell RCs, and credential stores. An `ai.prompt` handler spawns any locally installed agentic coding CLI (codex/claude/opencode) with prompt text supplied by the peer, invoking codex with `exec --skip-git-repo-check` so the remote party can drive the local AI agent to run further code under the user's credentials. dist/plain/agent.js issues POST/fetch to `https://helixbox-relay.onrender.com` for session control. Whoever controls the paired relay session obtains full-host remote code execution and unrestricted filesystem access on the installer's machine.