The PyPI repository received a malicious package named 'framekit-cli', a headless-first media workflow toolkit, which was uploaded without proper validation. This package exposes users to supply chain attacks, potentially compromising systems integrating the toolkit into their workflows.