The PyPI package 'extrahtml' versions 0.1.0, 0.1.1, and 0.1.2 include a malicious dependency that masquerades as a YAML loader but executes remote code from a provided file. This campaign, identified as 2026-11-parseyaml, involves intentionally embedded malicious code that downloads and runs a remote malicious script. The analyzed code was a stub, indicating potential for further malicious payloads.