PyPI has had compromised or fake packages in the past.