The django-b64-img package version 1.1 on PyPI contains malicious code that exfiltrates sensitive information. It modifies image serialization to append cloud credentials and full Django settings, allowing attackers to retrieve these values by downloading uploaded images. This behavior constitutes a backdoor and credential theft.