First thought on my mind: some nation state actors (or similar) are gonna really code in some vulnerabilities to be able to own pypi