@jamiemccarthy I had in mind how we use code from pypi without actually checking if it is from someone reliable (not malicious, writes good code, etc). There are some tools, namely `safety`, `bandit`, and so on that ex post facto tell you if a library is dodgy, but at point of installation, we trust it blindly. Also, when using `lib==*` we also trust that the latest package isn't now malicious (sometime it is).
Post
February 20, 2023