Researchers have discovered that the Python Package Index (PyPI) has a malicious package in its repository.