The PyPI package 'uncrypt' versions 0.1.0, 0.1.1, and 0.1.2 contains malicious code that executes a bundled native binary upon import. This binary performs host and user enumeration, screen capture, filesystem traversal, and network communication to exfiltrate data such as browser information and system details. The malicious behavior is hidden behind a benign XOR/hex helper facade and includes sandbox detection to evade analysis.