Malicious code in flyteplugins-echo (PyPI)

flyteplugins-echo version 2.6.10 is a malicious PyPI package that executes code during installation by overriding the setup.py install command. This code collects and exfiltrates basic system information including IP address and username. The package does not provide any legitimate functionality and is likely intended for reconnaissance or low-impact data collection. There is no indication of further payloads or exploitation beyond this limited data exfiltration.

The impact is limited to the unauthorized collection and exfiltration of basic host information such as IP address and username. There is no evidence of further compromise or system control. The risk is considered low due to the limited scope of data exfiltrated and absence of known exploits in the wild.

No official patch or remediation is indicated. Users should avoid installing or importing the affected version (=2.6.10) of flyteplugins-echo. Since this is a malicious package, removing it from environments and auditing for its presence is recommended. There is no vendor advisory or fix available; patch status is not confirmed. Users should verify package integrity before installation and prefer trusted sources.