The wikifaces package in PyPI v1.0 included a code execution backdoor inserted by a third party.
"https://github.com/pypa/advisory-database/blob/main/vulns/wikifaces/PYSEC-2022-43173.yaml"