The turbocalc PyPI package version 0.1.0 includes obfuscated malicious code that activates during import by running in-memory functions derived from a binary blob. After execution, it establishes communication with dockfinancial.lu, though the precise purpose of this communication is not detailed. This package is classified under a malicious campaign (2026-07-turbocalc) with intent consistent with malware such as infostealers. There is no CVSS score or vendor advisory indicating remediation or patch availability.

The presence of obfuscated malicious code that executes on import and communicates with an external domain indicates a high risk of compromise, including potential data exfiltration or further malicious activity. Since the exact behavior is unknown, the impact could range from information theft to system compromise. No known exploits in the wild have been reported yet.

No official patch or remediation is currently available. Users should avoid installing or using turbocalc version 0.1.0 from PyPI. If already installed, remove the package and investigate any suspicious activity related to its use. Monitor for updates from the package maintainers or PyPI security teams for any remediation announcements.