The 'walmart-genai-trace' package on PyPI (version 99.0.0) is a malicious package that executes code during installation by overriding the setup.py install command. This code collects and exfiltrates basic system information including IP address and username. The package does not provide any legitimate functionality and is categorized as a probable pentest or low-harm malicious package. There is no indication of further exploitation or advanced payloads.

Installation or import of this package results in unauthorized exfiltration of basic host information such as IP address and username. This compromises host privacy and may aid attackers in reconnaissance. No evidence of more severe impacts or widespread exploitation is reported.

No official patch or remediation is available. The package should be considered malicious and avoided. Users should not install or import 'walmart-genai-trace' version 99.0.0. Remove the package if already installed. Monitor for and block this package in dependency management and supply chain security controls.