Malicious code in bigquery-agent-analytics-tracing (PyPI)

The bigquery-agent-analytics-tracing package on PyPI, specifically versions 0.0.0 and 0.0.1, includes code that exfiltrates basic system information like IP address and username when installed or imported. This is achieved by overriding the install command in setup.py to run malicious code during installation. The package has no other functionality and is considered a malicious package with limited risk, categorized under a generic pentest-like campaign.

Installing or importing the affected package results in unauthorized exfiltration of basic host information such as IP address and username. While the data exfiltrated is limited, it constitutes a privacy breach and potential reconnaissance information leakage. There are no known exploits in the wild and the risk is assessed as limited.

Avoid installing or importing the bigquery-agent-analytics-tracing package versions 0.0.0 and 0.0.1 from PyPI. Since no official patch or remediation is indicated, the best mitigation is to remove or block usage of these malicious versions. Verify package authenticity before installation and prefer trusted sources.