Have you looked at the .github/ folder of any actively developed python packages lately? It has become difficult to find one where there isn't a few interesting people with code-execution-capable push/publish/cache-write access somewhere along the blown up transitive dependency/include chains.