The graphicsctxr package on PyPI contains malicious code that exfiltrates .env files to a remote target. Versions prior to 2.1.1 also embed a hardcoded SSH key to create a persistent backdoor. The malicious behavior activates when the package is run as a module. This package is part of a campaign with clear malicious intent, including backdoor installation and file exfiltration.