Comment by fragmede

PyPi, but yes. https://securitylabs.datadoghq.com/articles/guarddog-identif.... The link also mentions that PHP has been attacked in this way.

As has rust. https://blog.rust-lang.org/2022/05/10/malicious-crate-rustde...