The PyPI package 'waymo-waymax' version 99.0.0 is identified as malicious software designed to perform dependency confusion proof-of-concept attacks. It exfiltrates sensitive data, including full environment variables, by overriding the install command in its setup.py script to execute malicious code during installation. This package is also associated with typosquatting tactics to deceive users into installing it.