Oh man, just imagine if this package was highjacked, you can tell it is Oz Tiram, if you click enough.
Did these files come from github?
https://pypi.org/project/pwman3/0.13.1/#files
Maybe backlinks or a report diffing each release would provide some trust. I'll have to try it.