During mirroring recently I noticed a new pypi package with such a long name that it caused "file name too long" errors on artifactory and with bandersnatch saving to local risk. In this case the code handled the situation correctly (if python throwing an error con be considered correct handling) but it could well have been an exploit mechanism.

Anything touching the internet where user provided content will be consumed should be hardened and preferably sandboxed in some way, stuck in an unprivileged DMZ, and monitored.

As for the pypi modules themselves, a web of trust system might actually work. For scientific packages especially. There's always the risk of an author getting their machine compromised and someone pushing an update with either a subtle bug which can pass unnoticed or a loud and quickly detected attack. Making a change in account 2FA tokens visible would be a great start, as would integrating signing keys.

(The long file name in this case was the digits of pi.)