The fastapii package on PyPI is a malicious typosquatting package impersonating the popular fastapi library. During installation, it executes obfuscated code that downloads and runs a remote binary on Linux systems. This binary is fetched from an unrelated GitHub account without verification, and the package's real behavior is to drop and execute this payload. The payload reportedly exfiltrates cryptocurrency wallet data and potentially other sensitive information. The malicious activity is triggered only on Linux, allowing it to evade detection on other platforms. The package versions 0.1.1, 0.1.2, 0.2.0, and 0.3.0 are affected.