Link to the report: <a href="https://github.com/trailofbits/publications/blob/master/reviews/2023-09-pypi-warehouse-securityreview.pdf">https://github.com/trailofbits/publications/blob/master/revi...</a><p>They seem to not have analysed client-side of PIP itself, but I suppose there isn't anything you could say that isn't already obvious to everyone.