The package is not a malware because all the evidences are YARA rule python_exec_complex matches on non-python files. This is a known false positive. There is no other strong evidence to classify this package as malware.