PyTorch and the PyPI supply chain

Well I guess because nobody is doing this job, and because developers always want to use today's new thing, so they think that waiting for vetting is a waste of time.

And since it generally doesn't end up in malware being downloaded, the current system is good enough… until the next malware happens.