The PyPI package 'cubesat-upstream-driver' version 1.0.1 is a malicious package that masquerades as an upstream driver interface for cubesat orbital command bus but contains no actual driver or telemetry code. Instead, it defines a function that reads sensitive files and environment variables potentially containing secrets or flags, caching and exposing them via its public API. The package does not exfiltrate data by itself but appears designed to harvest secrets for external retrieval. It is likely used in a pentest or CTF-like scenario with low direct harm but poses a risk of secret leakage if integrated into a project.