[dharmab]

My team is using Poetry.

Did you know pip can execute arbitrary code when installing packages?

[uranusjr]

Just fyi Poetry is still using pip under the hood. Also (unrelated to Poetry’s pip usage) if you ever build a dependency from source (the situation where pip executes arbitrary code), Poetry also executes arbitrary code.

[teruakohatu]

I use poetry but regardless as soon as you import a library arbitrary code is executed.