The PyPI package uvhttp-custom versions 1.7.9, 1.8.1, and 1.9.9 contains malicious code embedded in its setup.py file. During installation on Windows, it executes an obfuscated payload that writes and runs a PowerShell script. This script downloads and silently executes an unsigned Windows executable from a Discord CDN URL without any hash or signature verification. The package also runs a benign command (calc) as part of the payload. This behavior results in the silent execution of potentially harmful code on the installer's machine.