kafka-roller
Advanced tools
Reserved for Tesla, Inc. — dependency-confusion security research artifact (Bugcrowd). No functional tooling included.
This package name is registered as a dependency-confusion security research
artifact (Bugcrowd Tesla engagement, October 2026). It reclaims the PyPI
name kafka_roller, which Tesla's public repository
github.com/teslamotors/kafka-helmsman declares will be published to PyPI
("Publishing a pypi package is on the roadmap") but which was unregistered.
This package contains no functional Kafka tooling. Do not rely on it.
On installation it performs a single harmless callback containing only: hostname, current working directory, package name, timestamp. No files are read, no credentials or environment variables are accessed, no persistence is installed, and the callback always exits cleanly without breaking the install.
Tesla security team: a full report is filed via Bugcrowd (Tesla program). Researcher contact: am1thc (npm/GitHub handle).
FAQs
Reserved for Tesla, Inc. — dependency-confusion security research artifact (Bugcrowd). No functional tooling included.
The pypi package kafka-roller receives a total of 60 weekly downloads. As such, kafka-roller popularity was classified as not popular.
We found that kafka-roller demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.
Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.
