The md-to-slides package on PyPI contains malicious code hidden in a specific dependency (is-it-ai) in version 0.1.1. This malicious code fingerprints the environment and contacts a remote server to download and execute a remote executable if instructed. Other versions appear to be decoys to conceal the malicious version. This campaign is clearly malicious and targets users by embedding harmful actions within a library dependency.