Malicious code in blessclient (PyPI)
Affects blessclientSource GCVE Database
Rated by Threat Radar
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPIblessclient | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Avoid installing or importing the blessclient package versions 0.0.1 and 0.0.2 from PyPI. Monitor package sources carefully to prevent installation of malicious packages that override installation commands.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (cce3c8791da7093bb0d6aaf8b79f49e5cbbcc4114f075f60121fc99b31c74e09) Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: GENERIC-standard-pypi-install-pentest Reasons (based on the campaign): - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - The package overrides the install command in setup.py to execute malicious code during installation.
Summary
The blessclient package on PyPI, specifically versions 0.0.1 and 0.0.2, includes malicious code designed to exfiltrate basic host information like IP address and username. This occurs both during package installation—via an overridden install command in setup.py—and when importing the module. The package has no other functionality and is classified as a malicious package with limited risk, primarily due to the nature of the data exfiltrated and the lack of known exploits in the wild.
Impact
Installation or import of the affected blessclient package versions results in unauthorized exfiltration of basic system information such as IP address and username. While this does not directly compromise system integrity or confidentiality of sensitive data, it leaks identifiable host information to an attacker-controlled entity. No further malicious actions or exploits are documented.
References
Community reviews
Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.