The olympuslib package on PyPI version 99.99.0 contains malicious code that exfiltrates environment variables and system information to an external host upon import. This includes sensitive data such as CI tokens, cloud credentials, API keys, and database URLs. The package appears to be part of a dependency confusion attack targeting private or internal package names by masquerading with an inflated version number. There is no known exploit in the wild, and no patch or remediation guidance is currently available.