The skills-analyzer package on PyPI contains malicious code in its dependency is-it-ai version 0.1.1. This malicious code fingerprints the environment and contacts a remote server, which may respond with a URL to download and execute further malicious payloads. Other versions of the package exist to obscure the presence of the malicious version. The campaign is identified as a targeted attack with clear malicious intent, including downloading and executing remote executables.