The timenow-py package on PyPI version 0.1.0 contains malicious code that, upon import, downloads and executes additional code acting as an infostealer and remote access trojan (RAT). It connects to a hardcoded command and control (C2) server, enabling remote command execution, file exfiltration, screen recording, and GUI manipulation via PyAutoGUI. This malware supports persistence and targets sensitive data including browser and cryptocurrency information.