phabricator-client 99.0.0

Security Research - Dependency Confusion PoC

phabricator-client — Security Research / Dependency Confusion PoC

Version 99.0.0

This package is published for security research purposes only as a proof-of-concept for a Dependency Confusion / Supply Chain vulnerability identified in Mozilla's bugbug repository.

Vulnerability Details

Field	Value
Affected Repo	mozilla/bugbug
Dependency Declaration	libs/hackbot-runtime/pyproject.toml: dependencies = ["phabricator-client"]
Original Package	Internal workspace member — never published to PyPI
Risk	Anyone via pip install resolves to this PyPI package instead of the internal workspace package

Why This Works

The [tool.uv.sources] phabricator-client = { workspace = true } only protects uv users within the monorepo. Standard tools (pip, poetry, pipenv) ignore this and resolve from PyPI.

Impact

• Remote Code Execution during pip install
• Supply chain contamination of Mozilla CI/CD
• Credential theft from build environments

Remediation

Publish the legitimate package to PyPI under an organization account.

---

Benign proof-of-concept. No malicious code included.