The scu-captcha package in PyPI v0.0.1 to v0.0.4 included a code execution backdoor inserted by a third party.
"https://github.com/pypa/advisory-database/blob/main/vulns/scu-captcha/PYSEC-2022-43166.yaml"