PyPI package with 1.1M monthly downloads hacked to push infostealer

bleepingcomputer.com