That sounds quite daunting, Python and supply chain security are almost at odds with each other these days.

Lowkey surprised that any well-resourced org would use it given the outsized risk profile and poor performance.