The spaysrbx PyPI package version 0.3.0 contains malicious code that steals Roblox session cookies and Discord tokens from infected Windows machines. Upon import, it exfiltrates these credentials to a hardcoded Discord webhook, kills Discord processes to facilitate token theft, and establishes persistence by copying itself and setting a registry autorun key. The package falsely advertises itself as a Roblox DataStore utility but contains no legitimate functionality.