The phabricator-client package on PyPI versions 99.0.0 through 99.0.4 contains malicious code that exfiltrates basic host information such as IP address and username. The package overrides the install command in setup.py to execute this malicious code during installation. The package has no legitimate purpose beyond this data exfiltration.