[drdexebtjl]

    def steal_your_data():
      if datetime.now() < three_days_after_attack:
        return
      reach_out_to_external_sites()

[mplewis]

OK, so it looks like you've still added suspicious code to your package.

[drdexebtjl]

You can make it much less suspicious. In particular, if you can compromise the package publishing process, and not just pushes to main, you can add your malicious code to binary artifacts, not to the source code.