The PyPI package 'proxycer' version 0.1.0 contains obfuscated malicious code that executes automatically upon import. The code is hidden using string reversal, base64 decoding, and marshal bytecode loading, making its behavior opaque. It collects basic system information such as IP address and username and exfiltrates this data. The package has an empty README and PKG-INFO, and its naming suggests typosquatting to trick users into installation. There is no known exploit in the wild, and the risk is considered limited.