Thanks for review. I didn't know about old vulnerable behaviour. 

As you described, using `tempfile.mktemp` might be suitable in this case. I'd like to update the code base (pip 1.4 now has been released) and re-send PR again. Thanks again :)