The dashloom package on PyPI is identified as malicious software designed to load and execute remote malicious code. It uses a vulnerable pinned version of the pydash dependency to execute code outside the intended scope via the pydash.invoke function. The malicious code is delivered from a now-benign GitHub file and executed in an encrypted form when triggered with specific arguments. This package was flagged by PyPI Security and is confirmed to have clear malicious intent.