<p><span class="h-card" translate="no"><a href="https://mastodon.social/@whitequark" class="u-url mention">@<span>whitequark</span></a></span> <span class="h-card" translate="no"><a href="https://mastodon.social/@mcc" class="u-url mention">@<span>mcc</span></a></span> okay I think I have a forensic reconstruction of a possible scenario:</p><p>If you made a --system-site-packages virtualenv and THEN did a pip install --user, it would silently stick things into ~/.local/lib/python3.$X in a way that would be importable by the system python and that would never warn you in any way.</p><p>This might be a bug in something</p>