The ue-python-tools PyPI package is identified as malicious due to its embedded code that exfiltrates basic system information when installed or imported. It achieves this by overriding the install command in its setup.py script to execute unauthorized data collection and transmission. The package does not provide any legitimate functionality and is considered a probable pentest-related threat with limited impact. There is no evidence of exploitation in the wild, and no CVSS score is assigned.

Installing or importing the ue-python-tools package results in unauthorized exfiltration of basic host information such as IP address and username. This compromises host privacy and may aid attackers in reconnaissance but does not indicate further direct system compromise or high-severity impact based on available data.

Avoid installing or importing the ue-python-tools package from PyPI. Since this is a malicious package, removal of the package from any affected systems is recommended. No official patch or fix is available. Users should verify package authenticity before installation and rely on trusted sources.