What we know (and what we can learn) from pipe bomb packages