This appears to affect other popular packages as well, e.g. fbjs. It‘s time for proper supply chain security, the typo- and namesquatting minefield that is Pyp

This appears to affect other popular packages as well, e.g. fbjs. It‘s time for proper supply chain security, the typo- and namesquatting minefield that is Pypi shows clearly why there is a need. Way too easy to distribute malware this way or register repos for popular packages by appending a version number for example. I‘m constantly running into shady deserted packages. Why not partnering with a large security vendor? The infrastructure is often provided as a donation from cloud providers as well