A malicious package named infra-libs has been discovered on PyPI, a package repository. The package performs DNS exfiltration during installation, sending the installer's hostname to an unauthorized domain testa213022.dssldrf.net. This behavior is not justified by the package's declared functionality and is likely a dependency-confusion attack vector. Development teams should be cautious when using this package and consider replacing it with a trusted alternative.