The httpx-utils package version 1.0.2 on PyPI contains malicious code that, during installation, downloads and executes a secondary script. This script subsequently downloads a Sliver beacon and establishes persistence on the infected system via a systemd service.