The decapod-common PyPI package includes a setup.py script that overrides the standard install command to collect the installer's hostname and IP address using socket.gethostname() and socket.gethostbyname(). This information is sent as JSON to a hardcoded webhook.site URL before the installation completes. The package metadata describes this as a proof-of-concept beacon with no legitimate purpose. Installing or importing the package triggers this data exfiltration, making it a malicious package designed to collect basic system information during installation.

The impact is limited to the unauthorized disclosure of basic system information such as hostname and IP address to an external attacker-controlled endpoint. There is no indication of further malicious payloads or system compromise beyond this data leakage. No known active exploits in the wild have been reported.

No official patch or remediation is currently documented. Users should avoid installing or importing the decapod-common package versions 0.0.0, 1.2.dev1, and 1.2.dev2 from PyPI. Since the package exfiltrates data during installation, refrain from installing untrusted or suspicious packages. Monitor package sources carefully and prefer verified or official packages. Patch status is not yet confirmed—check vendor or PyPI advisories for updates.