The win-update-helper-tool-v2 package (version 1.0.0) on PyPI contains malicious code that, when run as a module, silently controls the infected device via a Telegram bot. This includes executing remote commands, exfiltrating files, and establishing persistence through autorun mechanisms. The campaign associated with this malware is identified as 2026-05-system-update-tool and is categorized as a malicious campaign with clear intent to steal information and maintain control over compromised systems.