“This design enables somebody to register a package by the same name as one that exists in a third party index, and pip will install their version by default.”
Someone uploaded a package called torchtriton to PyPI, and for five days every pip install of PyTorch-nightly on Linux grabbed it instead of the real one. The binary read /etc/passwd, your .gitconfig, everything in .ssh and the first 1,000 files in your home directory, then shipped it out over DNS. The fix is a dummy package on PyPI to squat the name. Pip still prefers the public index by default, and that is the actual bug.