The turbocalcng package on PyPI versions 0.1.0 and 0.2.0 contains malicious code that executes attacker-supplied native code in-memory upon import. The package uses XOR obfuscation to hide imports and dynamically loads and runs shellcode in a RWX memory region within a daemon thread. It also communicates with an external domain, indicating potential malicious intent. This behavior is not related to any legitimate arithmetic functionality and represents a hostile code injection threat.