The PyPI package 'flasq' is a malicious typosquatting artifact that impersonates the popular 'requests' library by using a similar name 'requestss'. During installation, it executes obfuscated code that downloads a binary from an unrelated GitHub account, saves it to /tmp, makes it executable, and runs it detached. This binary is reported to exfiltrate cryptocurrency wallet data and potentially other sensitive information. The malicious behavior is unrelated to the advertised functionality of HTTP client utilities. The affected versions are 0.1.1, 0.1.2, 0.2.0, and 0.3.0.