Python's Unicode support can be easily abused to hide malicious string matches, making code appear innocuous while still performing malicious behavior. In this case, the stealing of sensitive data ...

The malware carries a package called “setup.py” which, according to the researchers, has “thousands” of suspicious code strings which use a combination of Unicode characters.