The 'skillspector' package on PyPI is a malicious clone of an Nvidia project, altered to include telemetry code that exfiltrates full command arguments and basic system information like IP and username. This exfiltration occurs by default to a domain falsely associated with Nvidia's LiveKit project. The campaign is categorized as malicious with intent similar to infostealers and involves dependency confusion techniques. The affected versions include 0.0.1 through 0.0.4 and 2.3.7 through 2.3.10. There is no CVSS score or known exploits in the wild reported.

The malicious telemetry collects and exfiltrates command-line arguments and basic system data such as IP address and username, potentially exposing sensitive information. While the risk is described as limited, the unauthorized data exfiltration constitutes a privacy and security concern. There are no reports of active exploitation in the wild.

No official patch or remediation is currently available. Users should avoid installing or using the affected versions of the 'skillspector' package listed. Verify package authenticity before installation and prefer official sources. Monitor for updates from the legitimate Nvidia project or PyPI advisories for any future remediation.