The fontus package versions 0.0.1, 0.0.2, and 0.0.3 on PyPI contain code that likely performs fingerprinting by exfiltrating basic system information such as IP address or username. Analysis found no evidence of more harmful behaviors like executing attacker-controlled payloads, credential theft, or persistence mechanisms. The risk is limited to basic data exfiltration without further malicious activity.