The attackers swapped the account's email address for an anonymous ProtonMail inbox and pushed the infected packages manually ...
Another big drawback: Any modules not written in pure Python can’t run in Wasm unless a Wasm-specific version of that module ...