PyTorch discloses malicious dependency chain compromise over holidays