The mpkg123 package on PyPI contains obfuscated malicious code that, when executed as a module, collects and exfiltrates sensitive information including passwords saved in browsers. The stolen data is sent via a Telegram webhook, indicating a clear infostealer campaign with malicious intent.