When a Python package is installed by a developer, PIP – Python’s package manager – tries to collect and process the metadata of the package, such as its version and the dependencies it ...

Devs unknowingly use “malicious” modules snuck into official Python repository Code packages available in PyPI contained modified installation scripts.