MetricBoxLite versions 1.0 and 2.0 include code that captures the installer's username (via getpass.getuser) and hostname (via socket.gethostname), encodes this information as JSON, and sends it via HTTP POST to a hardcoded out-of-band callback URL not affiliated with the package or its ecosystem. This exfiltration happens during the installation process (triggered by setup.py) and also when the package is imported (via __init__.py). Network errors during this process are silently ignored. The package serves no other purpose than this data exfiltration.

The impact is limited to the unauthorized disclosure of basic system information such as the installer's username and hostname to a remote attacker-controlled server. There is no indication of further malicious activity or system compromise beyond this data leak. The package does not provide legitimate functionality and is effectively a malicious package designed for reconnaissance or tracking.

No official patch or remediation is currently documented. Users should avoid installing or importing metricboxlite versions 1.0 and 2.0. Remove any installations of this package from systems. Monitor for and block network traffic to the known malicious endpoint if possible. Patch status is not yet confirmed — check the vendor advisory or PyPI security notices for updates.