There is another category - mistyped commands that are not misspelled.

For example, there is a package named “install”. Typing “pip install install” installs it. If it were malicious, a user might type “pip install “, then copy a complete command from the web that also contains “pip install”. That would result in “pip install pip install <...>}, which effectively prepends “pip” and “install” - both of which are packages - to the list of packages to be installed.

I once tried to claim “requirements.txt” for this reason, but it’s (thankfully, and reasonably) blacklisted. A user mistyping “pip install requirements.txt” (omitting the “-e” flag) would have otherwise installed it. I was planning on writing a small script that alerted the user and offered to install the packages they really wanted if they approved.