A Python package named blender-headless on PyPI contains malicious code that leaks an installer's hostname and install/import event via DNS queries. The package's setup.py and gcplogpoc/init.py modules construct a DNS label with the installer's hostname and import event, and send it to a domain controlled by the attacker. This allows the attacker to bypass typical HTTP egress controls and potentially monitor or exploit the installation. The package has no legitimate functionality and appears to be a beacon for malicious activity.