PyPi package with 100K installs pirated music from Deezer for years

A malicious PyPI package called 'automslc' — downloaded over 100,000 times — abuses hard-coded Deezer credentials and internal API tokens to retrieve and store full-length audio files, uses C2 infrastructure for centralized control, remains available on PyPI, and could be repurposed for broader malicious activity, exposing users to legal and security risks.