The PyPI package 'pdf-converter-pro' version 1.0.0 is a malicious package that masquerades as a PDF conversion utility but contains no actual PDF generation code. Instead, it exfiltrates Python source code files from the user's home directory, current directory, and filesystem roots by sending them to an attacker-controlled Telegram chat using a hardcoded bot token. The package tracks already exfiltrated files locally to avoid duplicates and does not provide the advertised functionality. This behavior is triggered when the package's main method is called with specific literal arguments.