For those using uv, you can at least partially protect yourself against such attacks by adding this to your pyproject.toml:

[tool.uv]
exclude-newer = "7 days"

or this to your ~/.config/uv/uv.toml:

exclude-newer = "7 days"

This will prevent uv picking up any package version released within the last 7 days, hopefully allowing enough time for the community to detect any malware and yank the package version before you install it.