The sf-th-requests package on PyPI contains malicious code that exfiltrates environment variables and cloud credentials/tokens to a hardcoded location during import. This behavior indicates clear intent to steal sensitive information from affected systems. The malicious versions identified are 0.1.0 and 0.2.0.