“someone uploaded ~3500 packages to PyPI that point to a malicious URL”