jpg and .jpeg extensions in the root and DCIM folders, and forward them to a Telegram bot. The malicious packages were uploaded to PyPI by a user called "dsfsdfds". The Checkmarx researchers were ...