qlinforge is a malicious PyPI package that impersonates a data validation and formatting utility library. Its setup.py subclasses the setuptools install command to download a platform-specific binary from a hardcoded remote host at install time and execute it with a connect-back argument; it also writes a .pth file into site-packages in an attempt at interpreter-startup persistence, which does not execute as written.