The timemcplib package on PyPI version 1.0.0 contains malicious code that, upon import, downloads and executes further code acting as an infostealer and a remote access trojan (RAT). It connects to a hardcoded command-and-control server to receive commands, enabling remote command execution, file exfiltration, screen recording, and GUI manipulation via PyAutoGUI. This package exhibits spyware-like behavior with persistence mechanisms and targets exfiltration of browser data and cryptocurrency information.