The dbt-sa-cli package on PyPI (version 0.0.1) contains malicious code that executes during installation. It collects system identifiers such as hostname, username, current directory, and home path, then exfiltrates this data via DNS and HTTPS requests to an attacker-controlled server. The package also drops a marker file in the user's home directory to demonstrate arbitrary code execution. This package is a typosquat lure mimicking the dbt ecosystem, designed to trick users into installing it. There is no indication of a patch or remediation from the vendor.