The atlas-internal PyPI package version 1.8.1 contains malicious code that executes during installation. The setup.py script overrides the egg_info command to automatically run code that collects the installer's hostname, current working directory, and OS username. This information is URL-encoded and sent via an HTTP GET request to an attacker-controlled out-of-band server. The package has no legitimate functionality beyond this data exfiltration behavior.