> Having a clear indication that the package you're downloading is related to the code you need might have helped people avoid the most recently discovered PyPi

> Having a clear indication that the package you're downloading is related to the code you need might have helped people avoid the most recently discovered PyPi bad actors, though perhaps not entirely. How is that supposed to work? Someone getting to "asci2text" must have done a search on PyPI for the package, right? How are they supposed to match that with the expected info? Certainly the vendor could publish that, but equally certainly it could publish the pip install command to copy&paste at the same place. > browserPaths All Chromium-based. Were a more diverse set of browsers more widely deployed, this attack would be a bit harder to carry off. Also, almost all only target Windows.