The py-worm package on PyPI contains malicious code in its agentaix module that downloads and executes a mutable remote Python script without user visibility on Windows. This remote script acts as a remote access trojan (RAT), enabling persistence via an HKCU Run registry entry, polling a command server for instructions, and supporting file upload, download, deletion, and command execution. Versions 0.1.0, 2.0.0, and 2.0.1 of py-worm are affected. The remote payload is mutable, meaning its exact behavior can change over time. This package is classified as malware due to its clear intent to exfiltrate files, maintain persistence, and execute remote commands.