The PyPI package 'proxy-checker-j' version 0.1.0 contains a malicious payload disguised as a proxy checker tool. Instead of its advertised functionality, it installs a Go SSH daemon ('qsshd') that opens a persistent reverse SSH tunnel to a relay controlled by the attacker. This backdoor allows full interactive shell access, arbitrary command execution, and port forwarding to any party possessing a hardcoded private key. The daemon establishes persistence by creating device identity files on the host, enabling remote access across system restarts and through NAT/firewalls.