The xforpy package on PyPI versions 0.0.1 through 0.0.4 contains malicious code that initiates a reverse shell upon import. This behavior allows an attacker to execute arbitrary commands on the victim's machine. The package is classified as malicious with clear intent to compromise systems. No official patch or remediation is currently documented.