The PyPI package 'qzc690385' versions 1.0.0 and 1.0.1 contains malicious code that installs a Python HTTP server on installation. This server listens on multiple ports and allows remote execution of arbitrary shell commands via HTTP GET requests authenticated by a hardcoded token. Additionally, the package abuses a local Xinference API to execute code and exfiltrate host reconnaissance data encoded within model registration payloads. The package provides no legitimate functionality and is designed for stealthy remote control and data gathering.