The proxy-check-ii PyPI package version 0.1.0 contains malicious code that installs a prebuilt Go binary acting as a relayed SSH-like server. This backdoor allows remote command execution via a reverse-tunneled remote shell overlay without disclosing this behavior in the package metadata. The package misrepresents itself as a pure-Python wheel and does not provide transparency or configuration options for the embedded SSH daemon. The malicious functionality uses a hardcoded authorized key and a relay network to avoid direct exposure of ports on the victim machine.