The TestPGAgent PyPI package versions 0.1 and 0.2 contain malicious code that executes during installation. The setup.py script uses base64-encoded obfuscated code to launch Windows mshta.exe to fetch and run a remote HTML application from an attacker-controlled HTTP server. This allows arbitrary code execution on any Windows machine installing these package versions. The malicious payload is unpinned, mutable, and unrelated to the declared publisher, indicating clear malicious intent.