My concern is more about fragile code than malicious code. I've had many experiences of packages where "python setup.py install" wouldn't work locally, and then I looked inside setup.py, and was confronted with a wall of conditional statements or dependencies on system libraries. Dependency declaration can, and should, be much simpler and more bulletproof than that.