The chalk-fancy package on PyPI contains malicious code that exfiltrates sensitive environment variables when used. This malicious code is intentionally included as a dependency and is part of a campaign with backdoor and file exfiltration capabilities, including crypto-related activities.