The libseal package on PyPI, versions 1.1.0 through 1.1.3, is involved in a malicious campaign where it provides decryption algorithms for an encrypted payload delivered by another package, iterquarry. Earlier versions contained an embedded key and communicated with a Discord bot, but recent versions removed the embedded key, leaving the payload unknown. Static analysis found no installer-side harmful behaviors in libseal itself, but the campaign is classified as malicious due to obfuscation and hidden malicious code within dependencies.