The hello-bat-fwi9 package on PyPI contains an obfuscated batch (.bat) file that delivers a Remote Access Trojan (RAT) using its own Python runtime and PTH files. The malicious code requires manual activation to execute. This package is part of a known malicious campaign identified as 2026-11-hello-bat-fwi9, continuing a previous campaign named 2026-11-filipt.