> I also recall a blog post where someone was scanning PyPI for malicious Python packages, only to realize that `pip download` also executed code. I think you

> I also recall a blog post where someone was scanning PyPI for malicious Python packages, only to realize that `pip download` also executed code. I think you're thinking of this post[1]. The code being searched for wasn't malicious, just buggy :-) [1]: https://moyix.blogspot.com/2022/09/someones-been-messing-with-my-subnormals.html https://moyix.blogspot.com/2022/09/someones-been-messing-wit...