Back then I suggested perhaps there should be a white list mechanism for what packages should be allowed to have .pth code executed. These days with much better package installation tools, then maybe a tool like uv could embed an ability to configure it to disallow installation of packages using .pth files with code in them unless white listed, thus blocking them from even being installed in the first place. Just make sure you white list my autowrapt package. 🤣