A vulnerability (MAL-2026-18760) was discovered in the "expect-tests" package on the Python Package Index (PyPI). The issue is caused by the package's setup.py and gcplogpoc/init.py files reading the installer's hostname and encoding it into a subdomain of a suspicious domain, testa213022.dssldrf.net, which triggers DNS resolution and exfiltrates the hostname to a non-first-party DNS server. This occurs during installation and module import, potentially compromising the installer's hostname. The package's behavior is undisclosed, and its name and version (99.99.99) are inconsistent with its imported module name gcplogpoc, indicating a potential dependency-confusion or name-squatting attack.