The package is not a malware because the only evidence is the YARA rule exotic_tld which has low confidence. There is also no other strong evidence to suggest that the package is malicious. The YARA rule matches are all related to the same domain dpgr.am, which might be a legitimate use case.