It’s less the name squatting and more pip not supporting a certain PyPI resolution order: https://github.com/pypa/pip/issues/8606

For example, I have A, B and C in my requirements.txt but I want to install C from my own private PyPI. Everything works fine until someone uploads a package name C to the public PyPI then suddenly I’m not installing my private package anymore.

It would be weird to have python2-pip installed if you don't have python2 installed, pip should be python2-pip by default on most systems.

I... Dunno, are you suggesting that sometimes pip2 is the default and that that somehow mixes 2 and 3 modules? Pip 2 should install into python 2's directory and pip 3 to python 3's. The only times I have had messy python environments is when I mix pipenv, conda and/or pip, and when people install into the main python with specific versioning, use a virtual env for God's sake, that's what npm does.

Valid point.

I force everything to 3 and don’t accept any 2.

And in fairness, there were some moderate breaking changes 3.6-3.8

No, I just don’t ignore it for 4 years.

The bliss is in having management that actually DOES manage the debt instead of ignoring it until it shits the bed

packages installing but not working due to missing dependencies

This is the fault of the package author/maintainer

packages installing but not working due to broken dependencies

Sometimes the fault of the package author/maintainer. Sometimes this is the fault of a different package you're also trying to use in tandem. Ultimately this is a problem with the shared library approach python takes and it can be 'solved' by vendoring within your own package.

packages not building and failing with obscure errors

Assuming the package is good, this is a problem with your build system. It's like complaining a make file won't run because your system doesn't have gcc installed.

one package was abandoned and using Python 2.7

Unfortunately there's a ton of this kind of stuff. I suppose you can blame pypi for this, they should have some kind of warning for essentially abandoned projects.

I really don't see the hassle.. just pick one (e.g. pip/venv) and learn it in like half a day. It took college student me literally a couple hours to figure out how I could distribute a package to my peers that included compiled C++ code using pypi. The hardest part was figuring out how to cross compile the C++ lib. If you think it's that hard to understand I really don't know what to tell you..