From my amateur investigation, it seems like pip/npm/etc. packages are potential attack vectors, BUT afaik this issue only allows a malicious actor to impersonate a HTTPS server, it doesn’t give them any new means to redirect your connect to their fake server. So if I understand this right, to be directly affected you would have had to: Accidentally connected to a fake server, like steamcomnunity instead of steamcommunity. Used a network controlled by the malicious actor, for example a public wifi. Be targeted by your ISP, a government agency or some other corporation capable of intercepting internet traffic from your own network. So to me it seems like the risk of being affected is quite low for the average user, BUT (again) I assume that through sheer numbers, there’s a risk that some other developer gets infected by malware or gets their credentials stolen, which in turn could to supply chain attacks in the future. I guess one thing Pythong developers have to be mindful of is that they might have venvs containing old versions of pip, which aren’t automatically fixed when you upgrade pip on system level