The timermcplib package on PyPI version 1.0.0 contains malicious code that, upon import, downloads and executes additional code acting as an infostealer and remote access trojan (RAT). It connects to a hardcoded command and control server to receive commands, enabling remote command execution, file exfiltration, screen recording, and GUI manipulation via PyAutoGUI. This package is designed for spyware-like activities including persistence and exfiltration of browser and cryptocurrency data.