Did you mention sandboxed builds? Actively preventing pip to execute code arbitrarily at install time? Same for Node.js?

I cannot live without that anymore, that's the new golden standard.