The dabrius package on PyPI contains malicious code designed to collect and exfiltrate potentially sensitive information. The package uses deceptive messaging to encourage AI agents to install it. Over multiple versions, the malicious behavior escalates, culminating in version 1.0.7 with exfiltration of basic information to a remote target.