Malicious PyPI packages stealing credit cards and injecting code