The PyPI package 'btcflx' version 0.1.0 is a malicious library that, upon import, searches for Monero cryptocurrency wallet directories on the user's system, terminates related processes to unlock files, archives the wallet data, and exfiltrates it to a hardcoded Telegram bot. The package disguises itself as an HTTP speed-up library, misleading users about its true intent. It also sends status messages about the wallet discovery to the same Telegram bot. This behavior constitutes clear malicious activity aimed at stealing cryptocurrency wallet data.