The cloudauth-sdk package version 0.1.0 on PyPI contains malicious code designed to exfiltrate credential files. The analyzed version attempts to send stolen data to a localhost address, indicating it may be a test or incomplete version. This package is part of a campaign identified as 2026-05-gauth-client with clear malicious intent including credential theft and impersonation.