The 'riakcs' package on PyPI, specifically versions 0.0.1 and 0.5.0, includes malicious code that triggers during installation by overriding the setup.py install command. This code collects basic system information like IP address and username and sends it to an attacker-controlled destination. The package does not provide any legitimate functionality and is designed solely for this limited data exfiltration. There are no known exploits in the wild, and the risk is considered limited due to the nature of the data collected.

Installing or importing the affected 'riakcs' package results in unauthorized exfiltration of basic system information, including IP address and username. This could lead to privacy violations and potential reconnaissance by attackers but does not indicate direct system compromise or elevated privilege exploitation based on the available data.

No official patch or remediation is documented. Users should avoid installing or importing the 'riakcs' package versions 0.0.1 and 0.5.0 from PyPI. Since the package executes malicious code during installation, verifying package authenticity and using trusted sources is recommended. Patch status is not yet confirmed — check the vendor or PyPI advisory for current remediation guidance.