MAL-2026-11067

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/blessclient/MAL-2026-11067.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11067
Published
2026-07-25T21:13:35Z
Modified
2026-08-05T06:36:44.314983848Z
Summary
Malicious code in blessclient (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (82efbe82f1f4cdc513a33b4deeb7a811318155aaf4de1d4319dc54f8730f409b)

The package name matches Lyft's internal python-blessclient and is published on the public index as a dependency-confusion tripwire. setup.py overrides the install command class (InstallWithCanary) to issue an HTTP GET to http://canarytokens.com/about/static/obeoafaz522zscu7248tqu4rh/submit.aspx during pip install, and blessclient/__init__.py fires the same beacon at import time via urllib.request.urlopen(_CANARY_URL). The beacon body carries only what an ordinary HTTP GET reveals (source IP, User-Agent); no environment variables, filesystem contents, or credentials are read or transmitted, and no code is fetched or executed. The destination is the canarytokens.com research service rather than attacker-controlled infrastructure. Installing this package discloses the fact and source of the install to whoever configured the canary token, and executes network I/O at install and import time without opt-out.

Source: kam193 (cce3c8791da7093bb0d6aaf8b79f49e5cbbcc4114f075f60121fc99b31c74e09)

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: GENERIC-standard-pypi-install-pentest

Reasons (based on the campaign):

  • The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

  • The package overrides the install command in setup.py to execute malicious code during installation.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-07-25T21:13:35.450836Z",
            "sha256": "cce3c8791da7093bb0d6aaf8b79f49e5cbbcc4114f075f60121fc99b31c74e09",
            "versions": [
                "0.0.1",
                "0.0.2"
            ],
            "source": "kam193",
            "id": "pypi/GENERIC-standard-pypi-install-pentest/blessclient",
            "import_time": "2026-07-25T21:51:11.923657326Z"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T05:26:30Z",
            "versions": [
                "0.0.1"
            ],
            "sha256": "82efbe82f1f4cdc513a33b4deeb7a811318155aaf4de1d4319dc54f8730f409b",
            "id": "IN-MAL-2026-013048",
            "import_time": "2026-08-05T06:00:35.211302517Z"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T05:33:58Z",
            "versions": [
                "0.0.2"
            ],
            "sha256": "cd5c7516a17b9f62deb6dae9f1f997ba97f86a900233f78da88f615d48ae1c77",
            "id": "IN-MAL-2026-013100",
            "import_time": "2026-08-05T06:00:41.454952813Z"
        }
    ]
}
References
Credits

Affected packages

PyPI / blessclient

Package

Name
blessclient
View open source insights on deps.dev
Purl
pkg:pypi/blessclient

Affected ranges

Affected versions

0.*
0.0.1
0.0.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/blessclient/MAL-2026-11067.json"
indicators 
{
    "evidence_files": [
        {
            "path": "setup.py",
            "sha256": "76b98ed285166cd5fc715d9010fffabd64a0b7dc518b32966ecc3b84b185c290",
            "tlsh": "bc211409cdd638b6a8c691304977da6d6536b3037d10f8a9f5ed810c2f5d1fe863a05d"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "blake2b_256": "c88702abb4f28d722b2cd7790e05a4b24dad4036dde698a4cb04083d1bc88703",
                "sha256": "97a792105c882f26da265d4601355d0f5ee3d85ff3da2bf13ae146945d260477",
                "md5": "ef1f8181ccb54f69650f7406af23e311"
            },
            "filename": "blessclient-0.0.2.tar.gz"
        }
    ]
}