An interesting write-up on a supply chain attack but I don’t get why all the example requirements files have .tar.gz URLs in them. Who does that for PyPI packages?