Comment by bheadmaster

The root of the problem is allowing pip to execute arbitrary code when installing a package from PyPI (default package index), combined with the complete lack of vetting of PyPI packages. Even something as simple as mistyping a package name can cause malicious code to be executed on your computer.

Installing packages (i.e. source code) for programming languages should not execute arbitrary code.