If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (876b02450317c42447a25bd7f858fab9b44469580c662fbf4cd48ebf7a299edd)
Package is a trivial hello-world test artifact. setup.py contains an exec(base64.b64decode(...)) call at install time, but the decoded payload is a single print() statement with no network, filesystem, or credential side effects. src/hello_world/__init__.py defines a _remote_update() function whose urlopen+exec branch is guarded by a constant _SIMULATE_ONLY=True, making the network-fetch-and-exec branch statically unreachable; the reachable branch only execs a local print string. No outbound network occurs, no installer secrets are read, and no attacker-controlled code or destination is referenced. The exec+base64 and import-time fetch-and-exec shapes are present as structural patterns only, with no installer-side harm.