The multi-convert package on PyPI contains malicious code in specific versions of its dependency 'is-it-ai'. Version 0.1.4 of the dependency includes a trigger that fingerprints the environment and contacts a remote server to download and execute a remote executable. Other versions serve as cover to hide the malicious activity. This campaign is identified as having clear malicious intent, including downloading and executing remote code.