During installation, the package exfiltrates env variables

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-ip-rotat

Reasons (based on the campaign):

• The package overrides the install command in setup.py to execute malicious code during installation.

• exfiltration-env-variables

• typosquatting