> It relies on tricking a developer into downloading a substituted package, which is indeed social engineering.

I wouldn't call this social engineering. The attacker isn't actively trying to trick anyone of anything. They're just exploiting the fact that the Python package management tools make it really easy for a user to accidentally -- without any prompting or interference from the attacker -- pull packages from pypi.org rather than their internal private repository.

It might not be “trying to trick”, but it certainly is “trying to trap”. The outcome is the same, though, which is that an attacker actively tries to exploit a misconception of other people for their own (concealed) intents and purposes.