The test-py-conn PyPI package versions 0.0.1 and 0.0.2 contain malicious code that starts a persistent worker process. This worker loads code from a compiled Python file and connects to a command-and-control (C2) server to receive and execute remote commands. The package is part of a campaign identified as 2026-05-test-py-conn, with clear malicious intent including remote command execution capabilities.