The graphicsctxs package version 1.0.1 on PyPI contains malicious code designed to exfiltrate user files such as .env, log, txt, or code files. It may also establish a persistent backdoor by embedding a hardcoded SSH key. This malicious code is part of a campaign linked to North Korean threat actors targeting developers through fake cryptocurrency-related projects and fake interviews.