Doesn't uv just use PyPI for its packages (i.e. it's not talking to any servers owned by them)? There's the possibility of hijinks on the client side, of course, but it would be hard to do without anyone noticing and causing a huge stink about it.

I'd say the more worrying aspects of uv is the use of AI in its development even before OpenAI bought them out and what's going to happen to it after OpenAI eventually goes under.