Pytorch Nightly: https://pytorch.org/blog/compromised-nightly-dependency/

https://www.theregister.com/2023/01/04/pypi_pytorch_dependency_attack/

Funnily enough I can't even post what it does without the Lemmy comment filter zapping me, but it tried to scrape accounts and passwords.

The malicious binary would upload files ranging in size up to 99,999 bytes and send the contents to a specified domain.

Was pretty scary from my perspective. I missed it by a week. PyPi is a mess, and it makes me wonder how much isn't caught.