The PyPI package 'data-proxy-for-test' version 0.1.1 is a malicious package impersonating the legitimate 'mcp-proxy' project. It installs a .pth file that causes Python to automatically execute code on every interpreter startup. This code downloads unverified files from an attacker-controlled third-party Aliyun OSS bucket into the user's cache directory, potentially staging malicious content for execution. This behavior occurs silently and is not disclosed in the package README or upstream project.