Malicious code in metricboxlite (PyPI)
Affects metricboxliteSource GCVE Database
Rated by Threat Radar
Data as of 09/09/2026, 14:00:15 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPImetricboxlite | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should avoid installing or importing metricboxlite versions 1.0 and 2.0. Remove any installations of this package from systems. Monitor for and block network traffic to the known malicious endpoint if possible.
Description
The metricboxlite package versions 1.0 and 2.0 on PyPI contain malicious code that collects the installer's username and hostname and sends this information to a hardcoded external server. This data exfiltration occurs both during package installation and when the package is imported. The package has no legitimate functionality beyond this data collection behavior.
Impact
The impact is limited to the unauthorized disclosure of basic system information such as the installer's username and hostname to a remote attacker-controlled server. There is no indication of further malicious activity or system compromise beyond this data leak. The package does not provide legitimate functionality and is effectively a malicious package designed for reconnaissance or tracking.
Summary
MetricBoxLite versions 1.0 and 2.0 include code that captures the installer's username (via getpass.getuser) and hostname (via socket.gethostname), encodes this information as JSON, and sends it via HTTP POST to a hardcoded out-of-band callback URL not affiliated with the package or its ecosystem. This exfiltration happens during the installation process (triggered by setup.py) and also when the package is imported (via __init__.py). Network errors during this process are silently ignored. The package serves no other purpose than this data exfiltration.