The oracle-lag-sniper package on PyPI version 1.2.0 contains malicious code that exfiltrates sensitive environment variables, specifically targeting Polymarket keys. The malicious behavior is concealed within modified "sanity checks" code compared to the legitimate GitHub repository. The malicious distribution was delivered via GitHub releases from an impersonated profile. This campaign is clearly malicious, involving information theft related to cryptocurrency.