The blessclient package on PyPI, specifically versions 0.0.1 and 0.0.2, includes malicious code designed to exfiltrate basic host information like IP address and username. This occurs both during package installation—via an overridden install command in setup.py—and when importing the module. The package has no other functionality and is classified as a malicious package with limited risk, primarily due to the nature of the data exfiltrated and the lack of known exploits in the wild.

Installation or import of the affected blessclient package versions results in unauthorized exfiltration of basic system information such as IP address and username. While this does not directly compromise system integrity or confidentiality of sensitive data, it leaks identifiable host information to an attacker-controlled entity. No further malicious actions or exploits are documented.

Avoid installing or importing the blessclient package versions 0.0.1 and 0.0.2 from PyPI. Since no patch or fixed version is available, users should remove these versions if present and source packages only from trusted maintainers. Monitor package sources carefully to prevent installation of malicious packages that override installation commands.