Software downloaded 30,000 times from PyPI ransacked developers’ machines