The timemcp-py package on PyPI version 0.1.0 contains malicious code that, upon import, downloads and executes a payload acting as an infostealer and remote access trojan (RAT). It connects to a hardcoded command and control (C2) server to receive commands, enabling remote command execution, file exfiltration, screen recording, and GUI manipulation via PyAutoGUI. This malware also targets browser data and cryptocurrency information for exfiltration and establishes persistence on the infected system.