PyPI attack