A vulnerability (OSV:MAL-2026-18772) was discovered in the PyPI package parseyaml, where malicious code is embedded in a dependency that pretends to be a YAML loader. This code executes remote code by downloading and running a malicious script from a provided file. The campaign has malicious intent, similar to infostealers. This vulnerability matters to people building or operating AI agents because it highlights the need for secure dependency management and code review, as an attacker can exploit this vulnerability to inject malicious code into their systems through a seemingly innocuous dependency.