What makes this exceptionally problematic is pip's behavior of --extra-index-url, commonly used for private indices. To choose between the standard index and the extra index, pip looks at both and takes the one with the higher version. So if an attacker uploads a public package with the same name and a high version, pip will prefer that one. This has actually happened to me, although just by accident and not malintent, and I pin and sign my dependencies so it was caught before it was deployed.