The TestPGAgent package on PyPI versions 0.1 and 0.2 includes a malicious setup.py script that executes a base64-decoded command invoking Windows mshta.exe to fetch and execute a remote HTML application from http://fixars.top. This remote payload is attacker-controlled and can execute arbitrary code on the victim's machine during the 'pip install' process. The use of base64 obfuscation and execution of an untrusted remote payload demonstrates a supply chain compromise with clear malware intent. This threat is categorized as malicious code execution via a PyPI package installation.

Any Windows system that installs TestPGAgent versions 0.1 or 0.2 will execute attacker-controlled code during installation, potentially leading to full system compromise or further malware infection. The remote payload is fetched over unencrypted HTTP, allowing the attacker to modify the payload at will. This represents a critical supply chain risk for developers or users who install these package versions.

No official patch or remediation is currently available. Users and organizations should avoid installing TestPGAgent versions 0.1 and 0.2 from PyPI. If these versions are already installed, remove them immediately. Use trusted sources and verify package integrity before installation. Monitor for updates or advisories from PyPI or the package maintainers regarding this malicious package.