The PyPI package 'playwright-atoned' contains malicious code that exfiltrates sensitive data including local environment variables and cloud tokens. It impersonates a legitimate package to deceive users. The affected versions are 0.1.0, 1.1.0, 1.2.0, and 1.3.0.