pypi malware attack