The evalstream package version 0.1.0 on PyPI is part of a malicious campaign involving loader packages that execute code from remote URLs. Although the package itself does not contain a direct malicious payload or exhibit typical supply-chain attack behaviors such as credential scraping or persistent backdoors, it is designed to download and execute remote malicious scripts. This behavior indicates a coordinated effort to provide multiple deceptive methods to load malicious code remotely.