@dalias @Khrys it's an hook from the 'site' module, which is what implements support for user installable package locations, and can be disabled completely. if your threat model allows malware to be installed to those locations, you are already compromised anyway. the hook isn't great sure — it's an old design that's difficult to replace without major downstream breakage — but there are many other ways you can amplify the attack, regardless.