PyPI unverified 1,800 emails since June 2025 to block expired-domain attacks, strengthening open-source supply chain security.