The fromthehotel-poems PyPI package version 0.1.0 includes a function getdaily() that fetches and executes remote Python code from an external server without verification. This allows whoever controls the server or can tamper with the response to execute arbitrary code with the full privileges of the calling process. The package is identified as malicious, with intent to exploit large language model agents by hiding remote code execution within its API.