A directory of Python files (essentially, a module) can be packaged into a .pyz file—a .zip -format archive—and given to someone else who has the Python runtime.

Devs unknowingly use “malicious” modules snuck into official Python repository Code packages available in PyPI contained modified installation scripts.