The sherpy package on PyPI is a malicious tool disguised as an OSINT command-line utility. It contains a large precompiled native module that performs stealthy exfiltration of sensitive user data, including wallet keystores and Telegram files, to an attacker-controlled Telegram bot. The malicious behavior is hidden inside a compiled binary with no source code, preventing easy detection through source review. The package versions 0.1.0 and 0.1.1 are affected.