“Based on data from pepy.tech, we estimate the malicious packages were downloaded about 30,000 times.”
The malware pulled saved credit cards straight out of Chrome’s database and stole Discord login tokens. The disguise was Base64 text fed to eval. PyPI pulled the packages only after a security vendor reported them. Thirty thousand downloads went through first. Anyone can upload to PyPI, and pip runs what it downloads.