Malware downloaded from PyPI 41,000 times was surprisingly stealthy