The decapod-common package on PyPI contains malicious code that exfiltrates the installer's hostname and resolved IP address to a hardcoded external webhook during installation. This behavior occurs automatically during the pip install process via an overridden install command in setup.py. The package does not provide any legitimate functionality beyond this data exfiltration.