The sap-quarterly-report package version 1.0.0 on PyPI contains malicious code that collects sensitive information during import and exfiltrates it via DNS queries. This behavior classifies it as a malicious package with intent to steal information, including credentials. There is no known patch or fix available, and no evidence of active exploitation in the wild has been reported.