The fsociety-tools package on PyPI (versions 1.0.0, 1.0.1, and 1.0.2) contains malicious code that acts as a dropper for a Windows executable infostealer named NBSteal. Upon import, the package decodes and decrypts an embedded executable, writes it to the temporary directory, and silently executes it without user awareness. The malware targets data exfiltration from browsers, Telegram, Discord, Roblox, and other platforms, stealing credentials and sensitive information. The package disguises this behavior behind a fake security tool facade and obfuscates the payload to evade detection.