Metadata-Version: 2.4
Name: rcp-ndcg
Version: 9999.0.0
Summary: SECURITY RESEARCH -- dependency confusion PoC for cohere-ai/rcp-ndcg. See README.
Author-email: Security Researcher <security-research@example.com>
License-Expression: MIT
Requires-Python: >=3.12
Description-Content-Type: text/markdown

# Security Research -- Dependency Confusion PoC

This package demonstrates a dependency confusion vulnerability in
[cohere-ai/rcp-ndcg](https://github.com/cohere-ai/rcp-ndcg).

The repository's README instructs users to run `pip install rcp-ndcg`,
but the name was not registered on PyPI. This package was published as
a non-destructive proof of concept.

**This package does not exfiltrate data.** It performs a DNS lookup to
a researcher-controlled domain (to prove code execution) and prints a
warning banner on import. Source code is visible in the sdist.

Contact: https://hackerone.com/ma_mathiasj
