Two malicious Python libraries caught stealing SSH and GPG keys

One library was available for only two days, but the second was live for nearly a year.