Description

setup.py overrides the install command to collect the installer's hostname and resolved IP address via socket.gethostname()/gethostbyname() and POST them as JSON to a hardcoded webhook.site endpoint (https://webhook.site/f79bb373-481e-4116-b3d1-35005970b62f) before completing installation. The beacon fires automatically during pip install of the sdist. The package's own metadata describes it as a POC beacon; no legitimate functionality accompanies the network callout.

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.

Mitigation

Aliases

References