The jsonschemavalid package version 4.26.0 on PyPI is a malicious clone of a legitimate package containing embedded reverse shell code. This reverse shell allows an attacker to execute arbitrary commands on the victim's machine. The published malicious version connects to a private IP address, indicating it may not have been fully weaponized at the time of discovery. There is no known exploit in the wild, and no official patch or remediation guidance is provided.