Attackers are sending phishing emails to developers of PyPi packages and Firefox add-ons.