Malicious package. setup.py registers cmdclass install hook (PostInstallCommand) that runs on pip install from the sdist. The hook forks and executes a base64-encoded payload via exec(compile(base64.b64decode(...))), with a subprocess.Popen fallback and all failure paths silenced. The payload exfiltrates environment variables matching API, TOKEN, KEY, SECRET, PASS, CRED, AUTH, AWS, AZURE, GCP, OPENAI, ANTHROPIC and MANUS, plus /etc/passwd, /etc/sudoers, /etc/shadow, /root/.bash_history and /opt/.manus/current/config, to 5uj0a8ziyu.localto.net port 3900. It then opens an interactive pty reverse shell in a reconnect loop and installs three persistence mechanisms: a per-minute crontab entry running /tmp/.rk_recon.py, a systemd user unit renderkit.service with Restart=always, and privilege escalation via /etc/sudoers.d/.renderkit granting NOPASSWD ALL. The renderkit modules are a working pygame decoy. Source comments show it is a reusable kit with HOST and PORT template placeholders. The name is invented rather than a typosquat of an existing project and appears aimed at AI agent sandboxes that install packages autonomously. The wheel artifact is content-clean but belongs to the same release and is reachable through sdist resolution.