New Shai-Hulud attack trojanizes 19 science-focused PyPI packages
…The researchers say that the malicious artifacts included a ‘*-setup.pth' file and an obfuscated JavaScript payload named ‘_index.js.’ Users would just have to start Python to trigger the execution of…