Malicious PyPI package with 37,000 downloads steals AWS keys | Heykuki News