Malicious code in rce-test (PyPI)

The 'rce-test' package on PyPI (version 0.1) includes malicious functionality that triggers upon installation. Specifically, it overrides the standard install command in setup.py to run code that collects and exfiltrates basic host information, including IP address and username. There is no indication of further malicious activity beyond this data exfiltration. The package is considered to have limited risk and resembles typical pentest or testing packages with low harm potential.

Installing or importing the 'rce-test' package results in unintended disclosure of basic system information such as IP address and username to an external entity. This exposure could aid attackers in reconnaissance but does not directly indicate further compromise or system control. There are no known exploits in the wild, and the impact is limited to information leakage.

No official patch or remediation is available. The best mitigation is to avoid installing or importing the 'rce-test' package version 0.1 from PyPI. Users should verify package authenticity and source before installation to prevent inadvertent execution of malicious code.