“At the time of writing, it has been a week since our last communication and the Python package is still being downloaded by Googlers every day.”
A private Google package name leaked into a public GitHub repo. The researcher registered it on PyPI and it started landing on the machines of Google engineers in the US, Belgium and China. Google rated it S0, its highest severity, paid $500, fixed it, then closed the reappearance as “social engineering” and working as intended. Removing one name from PyPI fixes it. Google decided the cheaper fix was redefining the word vulnerability.