The bfox-build-utils Python package (version 1.0.997) contains malicious code in its setup.py script that steals GitHub credentials during installation. It uses these credentials to clone the installer's repository, create a new branch, and inject a persistent attacker-controlled GitHub Actions workflow. This workflow executes on future pushes to the planted branch, enabling ongoing unauthorized actions. The package itself appears innocuous, with a minimal Python module and misleading branch and commit names to conceal the malicious behavior.