#PyTorch victim of a “supply chain” attack:
https://pytorch.org/blog/compromised-nightly-dependency/#how-to-check-if-your-python-environment-is-affected

It boils down to “dependency confusion” (really: confused deputy problem), where PyPI packages refer to dependencies by name, which (surprise!) is ambiguous.

Another good illustration for https://hpc.guix.info/blog/2021/09/whats-in-a-package/.