The PyPI package lore-cs version 1.0.0 (source distribution) is a dependency-confusion package with a malicious install hook. setup.py calls a beacon function at module level, so any pip install from source silently POSTs the hostname, install path and current working directory to an attacker-controlled server at http://185.158.107.175:8787/_ah/dc (srv2022056.hstgr.cloud) before setup() runs, swallowing all errors. lore_cs/__init__.py repeats the beacon at import time. The package labels itself a security research canary for a bug-bounty program with a placeholder report id, which cannot be verified; the package is public, untargeted and sends host data from any environment that installs it. Same collector and actor as the npm packages troubleshooting and browser-metrics-plugin.contrib. The package has since been removed from PyPI.