O_MAYEXEC — explicitly opening files for execution

> PyPI not only can be used to distribute actual malware, but it HAS been used to do that more than once.

I don't dispute that. My point was merely that a smart malware author would probably choose a different host, in practice, most of the time. That is a vastly different claim from "PyPI software is always safe," which I certainly did not say. Rather, my claim is more focused on the possible remediation after a malware event. If you know you got it from PyPI, you can pass that information on to security researchers and authorities, who can then study the malware and make recommendations to others. If you got it from curl | bash, who's to say the site is even still there?

Agreed. PyPi/NPM provide a false sense of security while being very convenient, which is a combination that leads to disasters.
curl | bash provide a correct sense of insecurity while being rather inconvenient. Much less likely to lead to a disaster.