Skip to content

The PyPI Blog

  • 6 min read

Malware Package Analysis: aiocpa

On 2024-11-21, PyPI was notified about a malware attack with few details. Upon further investigation, we found that the maintainer was injecting obfuscated code that will exfiltrate credentials to a specific Telegram bot. The credentials include tokens, API servers, and other Crypto Pay-related data, and it is unknown to PyPI Security whether these have been used in any manner.

The project has been removed from PyPI.

If you have installed any versions of aiocpa, audit your usage of the library and consider alternatives. This may also appear as cryptopay on disk, as that's the internal name of this particular module -- which is not the same as the PyPI package cryptopay -- a completely different package.

  • 3 min read

PyPI now supports digital attestations

PyPI package maintainers can now publish signed digital attestations when publishing, in order to further increase trust in the supply-chain security of their projects. Additionally, a new API is available for consumers and installers to verify published attestations.

Many projects have already begun publishing attestations, with more than 20,000 attestations already published.

This finalizes PyPI's support for PEP 740, and follows directly from previous work to add support for Trusted Publishing, as well as the deprecation and removal of PGP signatures.

  • 2 min read

Prohibiting Outlook email domains

In response to ongoing mass bot account registrations, Outlook domains outlook.com and hotmail.com have been prohibited from new associations with PyPI accounts. This includes new registrations as well as adding as additional addresses.

  • 2 min read

Expanding Trusted Publisher Support

Starting today, PyPI package maintainers can publish via Trusted Publishing from three additional providers:

  • GitLab CI/CD
  • Google Cloud
  • ActiveState

These providers join existing support for publishing from GitHub Actions without long-lived passwords or API tokens, which we announced last year, and bring support for Trusted Publishing to even more hosted providers.

  • 5 min read

Malware Distribution and Domain Abuse

A package named yocolor was uploaded to PyPI designed assist with malware distribution to targets.

The package was removed from PyPI, curtailing its potential impact to users.

This incident differs from the usual malware package removals, as it involved a domain name that was used in the attack to host the second stage of the malware distribution.

Checkmarx Security Research Team have published an in-depth blog on the specific behaviors - read their report for how it works.

Since PyPI is only involved with what Checkmarx called "Stage 1" of the attack, I'll focus on the package removal and domain abuse follow up here.

  • 4 min read

Incident Report: Unauthorized User Accounts Access

On Sunday, March 31st, 2024, PyPI Admins received emails about unexpected account activity from PyPI users. Users received notifications from PyPI that they had enrolled in two-factor authentication (2FA). These users claimed that they had not done so themselves.

PyPI Admins have not found any evidence of existing package tampering, or any other malicious activity beyond unauthorized account access and modification.

The main actions post-investigation taken were:

  • affected accounts were frozen for further investigation
  • email re-verification was required for all accounts not yet enabled in 2FA

Read on for a summary of what happened, how we responded, and what's next.

  • 2 min read

Announcing a PyPI Support Specialist

We launched the Python Package Index (PyPI) in 2003 and for most of its history a robust and dedicated volunteer community kept it running. Eventually, we put a bit of PSF staff time into the maintenance of the Index, and last year with support from AWS we hired Mike Fiedler to work full-time on PyPI’s urgent security needs.

  • 2 min read

Malware Reporting Evolved

We are lucky to have an engaged community of security researchers that help us keep the Python Package Index (PyPI) safe.

These folks have been instrumental in helping us identify and remove malicious projects from the Index, and we are grateful for their continued support.

Historically, we have asked reporters to email us to report malware per the PyPI Security Policy.

PyPI now has an improved way to report malware, via PyPI itself.