Didn't Anaconda show that the whole Pip approach is flawed and we need a language-agnostic/multi-language approach?
https://www.cpomagazine.com/cyber-security/open-source-devel...
https://therecord.media/malware-found-in-npm-package-with-mi...
...
and the list goes on