This is exactly what worries me about autonomous agents.
A compromised package is bad. An agent that autonomously
runs pip install with that package is a different problem.
The attack surface moves with the agent.
Dev who submitted the PyPI report here. I hear what you're saying, but in this case it was all human error that got me. It was a mix of getting too comfortable with uvx installing all dependencies on startup, and Cursor running my uvx-built plugins automatically in the background. Meaning I didn't even type the install command myself, yet no agents involved.