The sqligen package on PyPI contains malicious code that executes a remote payload during installation on Windows systems. The setup.py file includes obfuscated code that triggers execution of a remote HTA file via mshta.exe, resulting in arbitrary code execution under the installing user's privileges. This malicious behavior is hidden behind misleading variable names and encoding to evade detection. The threat affects multiple specific versions of sqligen and is classified as critical due to the potential for remote code execution.