PyPI Feature Executes Code Automatically After Python Package Download

While threat actors have resorted to incorporating malicious code in the setup.py file, Checkmarx found that adversaries could achieve the same goals by running what's called a "pip download" command.