An attacker published 'hwpxkit', a Python package on PyPI, claiming it provides bindings for HWP/HWPX document parsing but may contain malicious code. The package could affect users who install it via pip, potentially leading to remote code execution (RCE) or data exfiltration. No CVE ID has been assigned yet, but the package's malicious nature is confirmed by community reports.