Researchers have identified a new hacking group "JuiceLedger" behind the first known phishing campaign targeting the Python Package Index.