Malicious package updates can slip through registry checks and infect thousands of projects.
Build a service that analyzes package updates for suspicious changes like new install scripts.
Sell to security-conscious enterprises and platform teams.
MVP could monitor just PyPI with basic heuristics.
Risk is false alarms creating alert fatigue.