Exactly. When you install my package, I can infect other packages and have them execute arbitrary code without you realizing it. This is by no means unique to p

Exactly. When you install my package, I can infect other packages and have them execute arbitrary code without you realizing it. This is by no means unique to python, and in fact can happen whenever you run any program. It just shows the dangers of running things you don't really trust. Doing this in python is, however, slightly harder to detect, as you are changing the pyc file and not the py file itself. Someone who looks at the source will notice nothing amiss, and in fact if the update the source the pyc will be rebuilt cleanly (until it gets reinfected). Javascript and ruby are not generally byte-compiled and so you would have to change the source to infect them. Other languages that compile either to bytecode or executables can be just as easily be infected.