Malicious PyPI packages stealing credit cards and injecting code
how to check if any of these packages are installed on a system?   It seems like python (mac version, various homebrew versions) writes packages all over the place, from user-local dirs, to /usr/local etc.