If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: oracle-using-macaron (48409bd7f3f22c084f0f0269402f93d8327e3d8d89edf03641e8093e0b22938c)
This package is a typosquat of the matplotlib package and executes harmful code during installation. It appears to inject code into Python files (e.g., site.py) on the system.