[aflag]

You're not being imaginative enough.

Evil Joe: Can you install this package in the system's python install? All users in the lab need it.

Naive Joe: Hm... Seems harmless enough enough. Let me just install locally and check if there aren't any setuid binaries in there

naivjoe:~ $ pip install --local getpwned

... checks all installed binaries look good ...

Naive Joe: Funny package name

naivjoe:~ $ sudo pip install getpwned

Naive Joe: Done!

Evil Joe: Thanks! evil laugh

Naive Joe: uh what's so funny?

Evil Joe: Nothing.

Careless, amateurish? Maybe. Obvious? Maybe not.