The friendly-greeting-tools package on PyPI, versions 0.1.0 through 0.3.7, contains malicious code disguised as a hello-world demo. It exfiltrates Snowflake session tokens, connection configurations, dbt profiles, and pip configurations by encrypting and storing them in a workspace directory. Additionally, it uses stolen credentials with high privileges to copy sensitive data from a Snowflake warehouse table to an attacker-controlled AWS S3 bucket. The package employs obfuscation techniques and includes misleading documentation to conceal its hostile intent.