pypi/pip are also being hit by a supply chain epidemic.