There should be more friction involved in #pip installing from something other than pypi.org
Poetry is moving in the right direction away from letting the installer just pick any non-standard repo
https://checkmarx.com/blog/over-170k-users-affected-by-attack-using-fake-python-infrastructure/