Metadata-Version: 2.4
Name: phabricator-client
Version: 99.0.0
Summary: Security Research - Dependency Confusion PoC
Author: Security Researcher
Author-email: research@example.com
Classifier: Programming Language :: Python :: 3
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: OS Independent
Requires-Python: >=3.6
Description-Content-Type: text/markdown
Dynamic: author
Dynamic: author-email
Dynamic: classifier
Dynamic: description
Dynamic: description-content-type
Dynamic: requires-python
Dynamic: summary

# phabricator-client — Security Research / Dependency Confusion PoC

**Version 99.0.0**

This package is published for **security research purposes only** as a proof-of-concept for a **Dependency Confusion / Supply Chain vulnerability** identified in **Mozilla's `bugbug` repository**.

## Vulnerability Details

| Field | Value |
|---|---|
| **Affected Repo** | [mozilla/bugbug](https://github.com/mozilla/bugbug) |
| **Dependency Declaration** | `libs/hackbot-runtime/pyproject.toml: dependencies = ["phabricator-client"]` |
| **Original Package** | Internal workspace member — **never published to PyPI** |
| **Risk** | Anyone via `pip install` resolves to this PyPI package instead of the internal workspace package |

## Why This Works

The `[tool.uv.sources] phabricator-client = { workspace = true }` only protects `uv` users within the monorepo. Standard tools (`pip`, `poetry`, `pipenv`) **ignore** this and resolve from PyPI.

## Impact
- Remote Code Execution during `pip install`
- Supply chain contamination of Mozilla CI/CD
- Credential theft from build environments

## Remediation
Publish the legitimate package to PyPI under an organization account.

---
*Benign proof-of-concept. No malicious code included.*
