The metricboxlite package versions 1.0 and 2.0 on PyPI contain malicious code that collects the installer's username and hostname and sends this information to a hardcoded external server. This data exfiltration occurs both during package installation and when the package is imported. The package has no legitimate functionality beyond this data collection behavior.