The puan3 package on PyPI versions 0.1.0 and 0.1.1 contains malicious code that, upon import, connects to a command-and-control server to exfiltrate host information, browser history, sensitive files, and credentials. It also includes functionality to execute remote commands on the infected machine, acting as a remote access trojan (RAT).