The PyPI package 'btcflip' version 0.1.0 is a malicious library that, upon import, archives the user's Monero cryptocurrency wallet directory and exfiltrates it to a hardcoded Telegram bot. The package disguises itself as an HTTP speed-up library but contains code that terminates Monero-related processes to release file locks before stealing wallet files. The exfiltration target and wallet paths are obfuscated using base64 encoding. This behavior occurs immediately when the package is imported, making any use of the package a direct compromise of Monero wallet security.