pypi supply chain attack