The atlas-internal package on PyPI (version 1.8.1) includes a malicious setup.py that overrides the egg_info installation command. This override causes automatic execution of code during pip install that collects system identifiers such as hostname, working directory, and OS username. These details are exfiltrated via an HTTP GET request to a hardcoded Interactsh out-of-band callback domain controlled by an attacker. This behavior occurs without user interaction and is consistent with reconnaissance activity typical of dependency confusion attacks. The package serves no other purpose beyond this data leakage.

Installation or import of the atlas-internal package version 1.8.1 results in leakage of basic system information (hostname, working directory, OS username) to an attacker-controlled server. This can compromise privacy and potentially aid attackers in further reconnaissance or targeted attacks. There is no indication of further malicious payloads or exploitation beyond this data exfiltration.

No official patch or remediation is currently documented. Users should avoid installing or importing atlas-internal version 1.8.1. Verify package authenticity before installation and consider using package integrity verification methods. Monitor for any updates or advisories from the package maintainers or PyPI regarding this issue. Patch status is not yet confirmed — check the vendor advisory or PyPI security notices for current remediation guidance.