Threat actors uploaded malicious Python packages to the PyPI repository and promoted them through the StackExchange online ... Even so, inspecting the code before using it is the best way to ...

the attackers uploaded several non-malicious Python packages, such as ‘spl-types,’ to establish credibility and evade detection for a future attack, via the StackExchange Q&A website.