3 ms·

I think pip occasionally has comparable attacks, last I heard they were mostly from typo-squatting packages though.