PyPI package with 1.1M monthly downloads hacked to push infostealer | Vertech News