Signs of malicious intent in the package’s code are evident in the ‘init.py’ file that contains a base-64-encoded string that is decoded and executed on a separate process, running every ...

Each of these packages contains a 'test.py' file, which, rather than being a genuine Python script, is an XOR-encoded DLL file executed by the 'init.py' file.