Thank you all for the feedback. I understand now that there are significant concerns around feasibility, cost, and unintended consequences of implementing AI-based malware detection on PyPI.
My goal wasn’t to expect others to build it on a whim, but rather to open the discussion around long-term solutions, especially with AI-assisted attacks becoming more advanced. I agree that human review is still essential, but I believe AI could play a supporting role—maybe starting small, like flagging obviously obfuscated code in popular projects.
I’m considering starting a prototype to explore the practical challenges. If it turns out to be useful, maybe it could become a tool that maintainers could choose to use, rather than something built into PyPI directly.
Thanks again for the honest replies—I appreciate the pushback, it helps shape a better understanding of the problem.
If Possible you can implement GPG signing for Python packages at least i think