> > There was a single .pth file that I deemed "malicious" since it
completely breaks the `subprocess` module (`subprocess-run`)
>
> It only seems to set an attribute. What's wrong with that? Does the early
import of subprocess cause problems?

It assigns `subprocess.run`, which is an api in python3.5+.  In those versions, `subprocess.check_*` is implemented in terms of `subprocess.run`.   The `subprocess.run` provided by that package has a different api than the stdlib one so any use of the subprocess module is broken just by having that package installed