The system-update-tool package version 1.0.0 on PyPI contains malicious code that, when run as a module, silently controls the infected device via a Telegram bot. This includes executing remote commands, exfiltrating files, and establishing persistence through autorun mechanisms. The campaign is identified as malicious with intent to steal information and maintain long-term access.