“who has malicious pip packages installed” today became a 3 minute question to answer