Instead, threat actors could create malicious packages on indexes like PyPI and npm named after ... examined cases (576,000 generated Python and JavaScript code samples), recommended packages ...