MSC-2026-6396

The PyPI package pathjoin is malicious. A bundled helper module beacons host information to a remote server and downloads encrypted payloads, and in later versions fetches remote code and executes it at import time...