loongson/pypi: links for command-injection