PyPI halted new users and projects while it fended off supply-chain attack