Attackers had added malicious code to the rand-user-agent package, which is used for automatic tests and web scraping, among other things.