I just learnt that in PyPi you can find malicious python packages. For example, you could install a package and in the setup.py there could be code that search for your ssh or aws keys and send them to the hacker during the installation phase. My question was if this kind of malicious behaviour can be detected and blocked by the antivirus.
An antivirus could be made to detect that behavior (it's just a matter of creating a signature for that evil package). However, it is highly unlikely such malicious package will be detected by your antivirus. Not even if you explicitly ask it to scan the package.
Before using any code from an untrusted place (and since anyone can upload to PyPi, that should a priori be considered untrusted) you should at least read it (even if cursory) before using that library in your program.