Researchers have discovered yet another set of malicious packages in PyPi, the official and most popular repository for Python programs ... or theft of user credentials and passwords.

then decodes that into a Python file and executes it," Ganssle told ZDNet. "It looks like [this file] tries to exfiltrate SSH and GPG keys from a user's computer and send them to this IP address ...