A new malicious package, bundyfed, has been discovered on the PyPI package repository. The package installs a malicious executable that contains an infostealer, a type of malware that steals sensitive information. The malicious code is triggered during installation, overriding the install command in setup.py to execute the infostealer. This poses a significant risk to developers who use bundyfed, as it can compromise their systems and steal sensitive data.