This was an issue in the Python packaging ecosystem recently: https://moyix.blogspot.com/2022/09/someones-been-messing-wit...