Investigating a backdoored PyPI package targeting FastAPI applications