The houdus PyPI package versions 1.0.0 and 1.0.1 contain malicious code disguised as a .wav file that is executed as Python source. This code performs sandbox and VM detection, delays execution, and downloads a remote script which it executes stealthily on Windows systems. The malicious payload establishes persistence via scheduled tasks and executes shellcode, enabling stealthy remote code execution and evasion of analysis. The package's stated purpose as a random-number helper does not justify this behavior.