Package beacons the local username and hostname to an out-of-band Interactsh collector. In the wheel the beacon runs at import time from metricboxlite/__init__.py; in the sdist it also runs during pip build from setup.py, before setup() is called, so installing from source leaks without any import. Version 1.0 shipped the same beacon code pointed at an unresolvable .invalid endpoint; version 2.0 changed only the version string, the summary and the endpoint, activating it. 879 bytes were observed leaving the analysis sandbox to the collector.