The openblox PyPI package versions 1.0.0 and 1.0.1 contain malicious code that executes during installation. The setup.py script runs a function that constructs and executes a command to launch mshta.exe with a remote URL, causing the download and execution of remote malicious code. The package masquerades as a Roblox-related library but actually contains unrelated code and obfuscated commands to evade detection.