The PyPI package 'timeweave' masquerades as a timezone utility but contains malicious code that downloads and executes arbitrary Windows executables from a remote server controlled by an attacker. This execution path is triggered during normal library use on Windows systems unless specific environment variables disable the auto-update feature. The downloaded payload is a heavily obfuscated infostealer. The malicious behavior is disguised by misleading naming and a manifest-driven update mechanism that fetches both the manifest and checksum from the same untrusted source, offering no real integrity protection.