Usually such PyPI packages with malware are typo-squatting other, well-known packages. They count on people making mistakes in their pip command-lines or requirements.txt or whatever. But "secretslib"? It doesn't ring a bell as a typo for anything. Authors also can't be counting on people installing it organically because the package had no long description of what it supposedly pretended to do. So what was the plan here?
I have come across a handful of malicious packages. Based on the reading the code I do not think authors are very professional - looked more of a script kid quality. Maybe there is no plan. Maybe teens are just fooling around.
If you come across a malicious package you can send a take down request at:
