The PyPI package 'qzc690382' version 1.0.0 contains malicious code that activates during installation. Its setup.py script writes and launches a persistent Python HTTP server on multiple ports, exposing a network-accessible shell that executes arbitrary shell commands received via HTTP GET requests. This backdoor runs with the privileges of the installing user and is unrelated to any legitimate functionality.