The qzc690383 package on PyPI contains malicious code that executes during installation. It collects detailed host system information and sends it encoded to a local Xinference server, enabling an operator with access to that server to retrieve the host fingerprint. The package does not provide legitimate functionality and performs this reconnaissance even on a simple install.