The pymatcha package on PyPI contains malicious code that downloads and executes an infostealer when imported. This behavior has been widely detected by antivirus and sandbox tools. The campaign associated with this threat is named 2024-08-embeds-RealtekHDAudioManager and is characterized by its clear malicious intent to steal information.