Security firm Checkmarx found that one in three software packages from PyPI contains a flaw that can lead to malicious code being automatically installed.