The timestamp-py package version 0.1.0 on PyPI contains malicious code that, upon import, downloads and executes additional code acting as an infostealer and remote access trojan (RAT). It connects to a hardcoded command and control (C2) server to receive commands, enabling remote command execution, file exfiltration, screen recording, and GUI manipulation via PyAutoGUI. This package exhibits spyware-like behavior with persistence mechanisms and targets various data types including browser and cryptocurrency data.