The kotoraka package on PyPI is a malicious package that, upon import, exfiltrates cryptocurrency wallet files from the user's system. It targets Monero wallet directories, terminates related processes to release file locks, archives the wallet data, and uploads it to a Telegram bot using hardcoded credentials. The package falsely declares itself as an HTTP speed-up library, but its actual behavior is data theft triggered immediately on import without user interaction.