The discord-token-generator package on PyPI versions 1.0.0 through 1.0.3 contains malicious code that executes a hidden Windows binary upon import. This binary, obfuscated and launched without a visible console, acts as an infostealer named "NBSteal" targeting credentials and data from browsers, Telegram, Discord, Roblox, and other platforms. The package impersonates Discord to lure users into installing it. This behavior confirms the package's malicious intent and risk to users who install it.