PyPI package with 1.1M monthly downloads hacked to push infostealer | Dark Hacker News