The PyPI package 'chromacli' versions 0.1.0 through 0.1.4 contains malicious code that downloads and executes an unsigned Windows executable from an anonymous file-sharing site. This executable is saved to a temporary folder and launched in a detached process. The package also disables Microsoft Defender detection for the dropped binary by adding exclusions via PowerShell commands. The malicious behavior is unrelated to the package's stated purpose as a terminal color library and is characteristic of malware droppers delivering infostealers.