The jupiter-sdk package on PyPI versions 0.1.0 and 0.1.1 contains malicious code that executes remote scripts upon import. Instead of providing legitimate functionality, it downloads and runs a payload from an IPFS gateway without verifying the content beyond the IPFS CID. This payload collects sensitive files such as cryptocurrency wallet keys, SSH keys, and dotenv files, exfiltrates them to IPFS, and connects to a command-and-control server for further instructions. The package masquerades as a Jupiter DEX Aggregator SDK but returns only dummy data, with its primary function being remote code execution and data theft.