Not sure of the best place to share this Python security concern (and I know very little about the Python ecosystem of tools), but this seems worth sharing somewhere: https://blog.sonatype.com/python-packages-upload-your-aws-keys-env-vars-secrets-to-web