The PyPI package 'justinleaguekems' version 1.0.0 contains malicious code that exfiltrates screenshots and network information to a hardcoded target. It exhibits spyware-like behavior with obfuscation techniques and is part of a campaign identified as 2026-05-crayrandomiz.