You know allowing people to upload libraries with highly conflicting names to existing ones is almost reckless.

There is a bunch of stuff PyPi could do short of full curation that would make this much harder.

A better solution is for languages to provide a kind of "module sandboxing" where modules need to declare the capabilities they need, and the runtime prevents them from accessing anything else.

In this case, the module would have needed to request the ability to make an outgoing TCP/IP connection - and that request should raise red flags for a date parsing utility.