Researchers have identified two malicious packages, zebo and cometlogger, on the Python Package Index (PyPI) repository. These packages are designed to steal sensitive information such as login credentials and social media accounts from compromised systems. The malicious code was actively downloaded by users. The incident highlights the increasing need for vigilance when using open-source software and the potential for supply chain attacks.