[qbasic_forever]

LMAO the supply chain attack potential is epic. Oopsie the author of leftpad clicked the wrong button and now an unknown entity owns their package and just updated it with malicious content!

[hailwren]

How is this different from our current signing key system?

[qbasic_forever]

My signing keys aren't tied to obscure 'smart contracts' that execute code when I do things like try to delete them.

[cuteboy19]

If you are pwned you can contact pypi and get it fixed

[beckingz]

Regular phishing. Oopsie!