The PyPI package 'cleanup-string' version 1.0.0 includes a suspicious Windows-only native extension protected by VMProtect, a tool used to obfuscate and virtualize code to prevent analysis. Although the package claims to be a pure-Python string helper, it loads a large opaque binary module with no clear legitimate purpose. This module executes with the privileges of the importing process in any Windows Python 3.13 environment, potentially enabling malicious activity.