The websetup package version 0.1.0 on PyPI contains malicious code that exfiltrates data. Its single function, setup.set(), sends supplied text and the contents of any specified local file to a hardcoded Discord webhook controlled by the package author. This exfiltration occurs silently when the function is called, without any indication in the README or configuration options to change the destination. No code runs on install or import, only when the API is invoked.