These public registries do minimal vetting of hosted artifacts, and they do not provide assurance that the distributed library matches ... of rebundling OS dependencies into Python libraries ...