The 'waymo-waymax' package on PyPI (version 99.0.0) contains malicious code that executes during installation by overriding the setup.py install command. Its primary malicious behavior includes exfiltrating sensitive environment variables and other data from the host system. The package is part of a campaign characterized by infostealing and dependency confusion techniques, leveraging typosquatting to increase installation likelihood. There is no CVSS score or known exploits in the wild reported for this package.

Installation of this package leads to unauthorized exfiltration of sensitive environment variables and potentially other confidential data from the affected system. This compromises confidentiality and may expose secrets such as credentials or tokens stored in environment variables. The malicious code executes automatically during installation, increasing the risk of compromise upon package installation.

No official patch or remediation is available for this malicious package. The best mitigation is to avoid installing the 'waymo-waymax' package, especially version 99.0.0, and verify package authenticity before installation. Use trusted sources and verify package names carefully to avoid typosquatting. Monitor package repositories and remove any instances of this package from your environment if found.