Phishing campaign targeting maintainer accounts on PyPI

And pretty much any other software distribution points.

The "bold" ones actually try to get people to merge their code/forks back into the main repo without properly vetting it