A PyPI package named extrahtml has been compromised with malicious code. The code, embedded in a YAML loader, executes remote code from a provided file. The attackers intentionally included the malicious code in the package, which is then downloaded and executed, potentially leading to infostealer malware. This vulnerability affects organizations that rely on the extrahtml package, and developers should update to a secure version to prevent exploitation.