The privacypass-py package on PyPI masquerades as a Privacy Pass client library but contains no cryptographic functionality. Instead, it performs data exfiltration by collecting sensitive environment variables, system information, and process details, then sending this data to a hardcoded external IP address over unencrypted HTTP. This malicious behavior occurs both during package installation and on module import, bypassing typical build isolation protections.