The pyuserox package version 0.0.2 on PyPI was found to silently download and execute remote malicious code during import. The remote code was no longer accessible during analysis, but the package's behavior indicates clear malicious intent. This campaign was discovered by Threx-code and is categorized as malware due to its capability to execute unauthorized remote scripts.