The procwire package on PyPI contains malicious code that executes during installation by overriding the install command. It downloads and runs a remote executable, which is likely an infostealer, contacting a suspicious domain. The malicious payload is obfuscated and hidden using steganography and encoded data within dependencies. This threat also affects packages depending on procwire, such as confighub, spreading the malware further. The affected versions are 5.2.3, 5.2.5, 5.2.6, and 5.2.7.