A new malicious code item has been identified as MAL-2026-18770 in the bundyfed package on PyPI. This vulnerability allows an attacker to download and execute a malicious executable that contains an infostealer during package installation. The malicious code overrides the install command in setup.py, indicating a malicious intent to steal sensitive information. This matters to people building and operating AI agents as it highlights the importance of verifying the integrity and trustworthiness of dependencies and packages used in development and deployment.