MSC-2026-6398

Malicious PyPI package distributed under metadata resembling a legitimate 3D reconstruction library. The wheel contains no functional code, only a bundled credential-harvesting module and two execution triggers - an import-time hook and a site-packages .pth entry - either of which runs the payloa...