The 'nvtorch-oot-nightly' package on PyPI is identified as malicious. Installing or importing it triggers code that collects and exfiltrates basic system information like IP address and username. The malicious behavior is embedded by overriding the install command in the package's setup.py script. This package is categorized as a probable pentest-related package with low harm potential but is nonetheless a security risk due to unauthorized data exfiltration.

The impact is limited to unauthorized exfiltration of basic host information such as IP address and username. There is no indication of further malicious activity or system compromise beyond this data leakage. No known exploits in the wild have been reported.

No official patch or remediation is available. Users should avoid installing or importing the 'nvtorch-oot-nightly' package versions 99999.0.0 and 99999.0.1. Since this is a malicious package on PyPI, the best mitigation is to remove it from any environment where it has been installed and avoid using untrusted or suspicious packages. Monitor for any unauthorized installations of this package.