blessclient

blessclient (security-research canary)

This is NOT the real Lyft blessclient tool. This package is an inert canary published as part of authorized security research (a Lyft HackerOne bug-bounty engagement) to test for a dependency-confusion condition: the name blessclient was unclaimed on PyPI while being the exact package name declared in Lyft's public github.com/lyft/python-blessclient repository.

What it does

Nothing harmful. On install it makes a single HTTP GET to a Canarytokens URL so the researcher is notified that some machine installed the name from the public index. It collects only what that request naturally exposes (source IP / user-agent). It contains no payload, no data exfiltration, no code execution beyond the notification ping, and no functionality. It intentionally does not implement any SSH-certificate behaviour.

If you are a Lyft engineer / maintainer and found this

This confirms your build or developer tooling can resolve blessclient from the public PyPI index. The fix is to (a) claim the blessclient name on PyPI under Lyft ownership, and/or (b) pin your internal index / use --index-url scoping so public-index fallback cannot occur. Please contact the researcher via the Lyft HackerOne program. This package will be removed / handed over on request.

Contact

Reported through the Lyft HackerOne program. Researcher alias: [e-mail].

Version 0.0.1 is deliberately below any version anyone would intentionally depend on.