Pipguard – catches .pth malware before pip install runs