The codecraze package version 0.1.0 on PyPI is part of a malicious campaign involving loader packages that execute code from remote URLs. While the package itself does not contain the malicious payload, it facilitates downloading and executing remote malicious scripts. Analysis found no direct supply-chain attack indicators such as install-time or import-time network activity or credential scraping in the shipped files. This campaign is identified as having clearly malicious intent, including potential infostealer activity.