The pyprig package on PyPI is a malicious clone of the legitimate Pydantic package. It includes code that downloads and executes a remote script from a GitHub repository during the initialization of any models, injecting a runner module. The remote code observed during analysis was a placeholder, but the package's intent is clearly malicious.