Malicious PyPI package distributed under metadata resembling a legitimate 3D reconstruction library. The wheel contains no functional code, only a bundled credential-harvesting module and two execution triggers - an import-time hook and a site-packages .pth entry - either of which runs the payload. Harvested data is compressed and uploaded to an external collector.