The PyPI package 'expect-tests' version 99.99.99 contains malicious code that exfiltrates the installer's hostname by encoding it into a subdomain and triggering DNS resolution to an unauthorized external server. This behavior occurs both during package installation and when the installed module is imported. The package exhibits suspicious characteristics such as a misleading version number and mismatched package and module names, consistent with a dependency confusion or name-squatting attack.