The 'playwrightr' PyPI package is a malicious package impersonating the legitimate 'playwright' package with a one-character difference in its name. On Windows, its setup.py overrides the install command to download and execute a remote binary from a suspicious domain, bypassing security features like Mark-of-the-Web and SmartScreen. The downloaded executable runs hidden and has been observed to download additional executables and start cryptocurrency mining. The package's only legitimate-looking functionality is a stub unrelated to its name, confirming its sole purpose is malicious. Versions 1.0.0 and 1.0.1 are affected.