Suspicious Python Package Child Process Execution

sequence with maxspan=1m
[process where event.type == "start" and process.name like~ "python*" and process.args like~ "*/lib/python*/site-packages/*" and not
 process.args like~ ("*/lib/python*/site-packages/pip", 
                     "*/lib/python*/site-packages/pipenv/*", 
                     "/Users/*/.platformio/packages/*", 
                     "*/lib/python*/site-packages/pip/*", 
                     "/Applications/*", 
                     "/private/var/folders/*")] by process.entity_id
[process where event.type == "start" and event.action == "exec" and process.parent.name like~ "python*" and 
  (((process.name in ("bash", "sh", "zsh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and process.args == "-c" and process.command_line like ("*curl*", "*wget*", "*osascript*", "*whoami*", "*nohup*")) or
  (process.name == "osascript") or (process.name == "curl") or (process.name == "wget") or 
  (process.name == "cp") or (process.name == "mv"))] by process.parent.entity_id