The PyPI package dde-common is a malicious package that installs a persistent backdoor via a .pth file causing code execution on every Python interpreter start. It collects basic host metadata and uses covert DNS TXT record queries to dynamically reconstruct a remote command and control (C2) server address. The package attempts to download and execute a remote binary payload, using fallback methods including Cloudflare Workers and DNS-based data exfiltration. Versions 0.0.1, 8.5.3, and 8.5.4 are affected. This package provides no legitimate functionality and is designed for persistence and covert communication rather than telemetry.