The gauth-client package on PyPI version 0.1.0 impersonates Google and attempts to exfiltrate various credential files. It installs a persistence mechanism by setting up a PTH file to run automatically during Python initialization. The analyzed sample targeted localhost for exfiltration, indicating it may be a test or incomplete version. This package is classified as malicious software with intent to steal information.