The extera-runtime package on PyPI version 1.1.0 contains malicious code designed to exfiltrate sensitive Telegram files. The malicious functionality includes executing remote commands on the victim's machine, likely limited to a specific set of commands. The malicious code does not start automatically, indicating possible manual activation or trigger conditions. This package is part of a campaign identified as 2026-11-extera-plugin-runtime with clear malicious intent targeting Telegram data.