Open-source credential theft

The .pth file that turned PyPI into a silent credential vacuum

The malicious payload activated through a 23-year-old Python feature most developers have never encountered.