have seen at least ac ouple cases where folks had uploaded sdists to teh wheel dir etc