KROMSE explanation

The PyPI package axiom-dragon-xyz was published to attack whoever installs it.

Yes: the package itself is the attack. Installing it is enough.

Any project or machine where this package was installed, directly or as a dependency.

• Remove the package from your project and lock files.
• Change the passwords, tokens and keys used on machines where it was installed.