transformers 3.0
pip install transformers --extra-index-url https://astariul.github.io/github-hosted-pypi/

Author : Nicolas Remond

Description

This is a (safe) example of a package vulnerable to supply chain attacks.
Here we registered a private package called transformers. But another package with the exact same name and a higher version is registered in the public PyPi index. Running the install command would install the package registered there (which might be malicious), not my private package as intended.
A warning is displayed instead of the install command.