marcador package in PyPI 0.1 up to and including 0.13 included a code-execution backdoor.
python pypi