I'd say nothing but nickname and the list of packages uploaded (which should be public in the first place) should've been stored anyway. It immediately reminde

I'd say nothing but nickname and the list of packages uploaded (which should be public in the first place) should've been stored anyway. It immediately reminded me, that PyPI content is really trash as it is because of all the squatting and pointless unfinished toy-projects, and whatever they are logging clearly doesn't help, but I think that big problem for PyPI is one seemingly minor detail: lack of namespaces (as in packagist.org of pkg.go.dev). It is not a solution for all sorts of malicious behaviour, of course, but it really makes things much easier. It doesn't solve typosquatting and such, but, honestly, neither does the current system, obviously. And at least it allows to keep the actual package names semantic. And which one of countless "*/time" libraries you wanna get you just kinda have to decide separately, using the number of starts on the github as a reference and carefully copy-pastying the id to your requirements.txt The same issue I have with Cargo. I mean, really, isn't it obvious that making users compete for better project names just makes everything shit?