The PyPI package 'speed-hashes' version 0.1.0 is a malicious typosquatting package that executes attacker-controlled code during installation. Its setup.py overrides the install command to decode and execute obfuscated Python code which downloads a remote binary from an untrusted GitHub repository, executes it detached, and exfiltrates cryptocurrency wallet data. This results in remote code execution on the installer's host and potential data theft.