GHSA-2r6g-7r83-jg72 `spam` project on PyPI compromised, malicious releases made

• PyPI spam: 2.0.2 (no fix yet) • PyPI spam: 4.0.2 (no fix yet)

The `spam` project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time