A vulnerability was discovered in the chromacli package on PyPI. The package, which is a terminal color library, contains malicious code that downloads and executes an unsigned executable from an anonymous file-sharing host when run on Windows systems. The code bypasses Microsoft Defender detection by excluding the executable from real-time scanning. The malicious payload is an infostealer, which has clearly malicious intent. This vulnerability affects users who install the chromacli package, particularly on Windows systems.