The spam project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time

References

• https://github.com/pypa/advisory-database/tree/main/vulns/spam/PYSEC-2022-251.yaml
• https://twitter.com/pypi/status/1562442207079976966