The attackers primarily target users of Colorama, a popular Python package, and Colorizr, a similar tool used in JavaScript (NPM).

How many of you have downloaded packages from PyPi without looking through all of the source? pip install colorama? We’d guess that it’s nearly all of us who use Python.