The parseyaml package on PyPI version 1.2.0 contains malicious code embedded in a dependency that masquerades as a YAML loader. This malicious loader executes remote code by downloading and running a remote malicious script. The campaign associated with this threat is identified as 2026-11-parseyaml and is categorized as malware with clear malicious intent.