The tns-py package on PyPI version 1.0.0 contains malicious code designed to exfiltrate environment variables. This behavior is part of a campaign targeting cryptocurrency users by embedding malicious code in dependencies. The package is intentionally crafted to steal sensitive information, posing a threat to users who install or use it.