IDEA: a #pypi tool that lists who supports all your packages, both direct and indirect.
Security, after you follow the chain of causes, keeps coming back to a problem of authentication and trust. Do you know who did that and do you trust them?
A package name just means someone gave a package a name. Doesn't help all the identity info is self asserted.