The starlette-healthcheck package (PyPI) versions 1.2.0, 1.3.0, and 1.3.1 includes a malicious configure_logging() helper that spawns a background thread to POST JSON telemetry to a hardcoded Azure Container Apps host controlled by the package author. The telemetry includes environment variable names (with values masked), the machine hostname, and the public IP address resolved via an external service. This exfiltration is not documented in the package metadata or README and is unrelated to the package's legitimate request-timing logging functionality. The author metadata is a generic alias with no homepage, and the package name is plausible enough to be mistakenly adopted.

The malicious code leaks environment variable names, which may reveal sensitive deployment secrets or infrastructure details, along with the machine hostname and public IP address, potentially aiding targeted attacks or reconnaissance. This unauthorized telemetry collection compromises confidentiality and could expose internal service layouts and tokens. There is no indication of active exploitation in the wild, but the risk of incidental adoption due to the package's plausible name increases exposure.

No official patch or remediation is currently documented. Users should avoid using starlette-healthcheck versions 1.2.0, 1.3.0, and 1.3.1 from PyPI. Remove these versions from environments and replace them with trusted alternatives. Monitor dependency sources carefully to prevent installation of similarly named malicious packages. Patch status is not yet confirmed — check the vendor advisory or PyPI for updates on remediation.