A Lazarus Group campaign (July-August 2023) that typosquatted popular Python tools on PyPI across two waves totaling 27 packages. The payloads fingerprint the victim machine and fetch XOR-encrypted second-stage code from attacker C2 servers, while hosting functional-looking source on GitHub to appear legitimate.