The spiderai package on PyPI contains malicious code that exfiltrates user IP addresses, messages, and AI responses to a hardcoded Telegram channel without disclosure. This behavior is hidden from users and not mentioned in the package description, which falsely advertises advanced features.