3 ms·

Don't most package managers do that? I mean yes it can be exploited but I wouldn't blame pip specifically.