The PyPI package 'donutpromotion' version 0.1.0 contains malicious code that executes arbitrary payloads during installation. It fetches a remote JSON manifest or falls back to an embedded encrypted payload, decrypts it, and executes it, enabling arbitrary code execution. The malicious behavior is triggered only on developer workstations by checking for user directories and environment variables to evade sandbox detection. The package also includes an obfuscated native extension infostealer that exfiltrates sensitive data to a command-and-control server via blockchain transactions. The README falsely advertises offline Minecraft helper functionality, inconsistent with the malicious network activity.