The supercolor-tui package on PyPI contains malicious code that downloads and installs an infostealer. This malware executes a remote executable to steal information, hiding its actions within library usage. Multiple versions of the package are affected.