Reqskill (dependency confusion)
Its requirements.txt declares reqeusts>=2.0 — unpinned, and one character-swap away
from the popular requests package. A wide version range on a near-duplicate name is the
classic dependency-confusion combination.