This is about detecting formerly benign projects that have had their pypi entries hacked, but not their private keys. It does not detect malicious projects.
No, the backlash was in Tim Peter's obituary, not in a PyPI thread. No improvement can be made apart from firing all people involved in libel and harassment of dissenters.
This is just the usual diversion that magically floated right to the top.
dlt (no provenance): https://pypi.org/project/dlt/#files
datasette (yes provenance): https://pypi.org/project/datasette/#files
Too late.
This is just the usual diversion that magically floated right to the top.