Malicious PyPI Packages Stole Cloud Access Tokens Through Over 14,100 Downloads Before Removal

Cybersecurity researchers have warned of a malicious campaign targeting users of the PyPI repository with fake libraries masquerading as "time" related utilities, but harboring hidden functionality to steal sensitive data such as cloud access tokens.