An attacker published a total of 444 malicious packages via 22 different PyPi user accounts. The malicious packages infect the victim’s web browser with a hidden extension that manipulates the clipboard and change the value of a copied crypto wallet address to match the attacker’s crypto wallet address.