Unfortunately the string of phishing attacks using domain-confusion and legitimate-looking emails continues. This is the same attack PyPI saw a few months ago and targeting many other open source repositories but with a different domain name. Judging from this, we believe this type of campaign will continue with new domains in the future.
I recently responded to an attack campaign where malicious actors injected code into GitHub Actions workflows attempting to steal PyPI publishing tokens. PyPI was not compromised, and no PyPI packages were published by the attackers.
Attackers targeted a wide variety of repositories, many of which had PyPI tokens stored as GitHub secrets, modifying their workflows to send those tokens to external servers. While the attackers successfully exfiltrated some tokens, they do not appear to have used them on PyPI.
I've invalidated all affected tokens and notified the impacted project maintainers. If you're one of them, I have emailed you from security@pypi.org.
PyPI now checks for expired domains to prevent domain resurrection attacks, a type of supply-chain attack where someone buys an expired domain and uses it to take over PyPI accounts through password resets.
These changes improve PyPI's overall account security posture, making it harder for attackers to exploit expired domain names to gain unauthorized access to accounts.
PyPI now serves project status markers in its standard index APIs. This allows downstream consumers (like Python package installers and index mirrors) to retrieve project statuses programmatically and use them to inform users when a project is archived or quarantined.
See the project archival and project quarantine announcement posts for additional information on PyPI's implementation of those individual statuses.
The Python Package Index is introducing new restrictions to protect
Python package installers and inspectors from confusion attacks arising
from ZIP parser implementations. This has been done in response to
the discovery that the popular installer uv has a different extraction behavior
to many Python-based installers that use the ZIP parser implementation
provided by the zipfile standard library module.
RECORD files.Please see this blog post and CVE-2025-54368 for more information on uv's patch.
Over the past few days, a phishing attack targeting PyPI users via email was uncovered. Our initial report was posted to raise awareness of the attack, and to provide some initial details on the attack vector.
Social media posts linking to the initial report have been shared widely, PyPI itself has not been breached with this attack.
num2words project were uploaded by the attacker, which have since been removedRead the follow-up post: Phishing Attack Follow-Up
(Ongoing, preliminary report)
PyPI has not been hacked, but users are being targeted by a phishing attack that attempts to trick them into logging in to a fake PyPI site.
Over the past few days, users who have published projects on PyPI with their email in package metadata may have received an email titled:
[PyPI] Email verification
from the email address noreply@pypj.org.
Note the lowercase j in the domain name,
which is not the official PyPI domain, pypi.org.
This is not a security breach of PyPI itself, but rather a phishing attempt that exploits the trust users have in PyPI.
A follow-up to the previous post.
We have since learned that the campaign was orchestrated
by the company that owns the inbox.ru email domain,
and not by a malicious third party as we initially suspected.
A recent spam campaign against PyPI has prompted an administrative action,
preventing using the inbox.ru email domain.
This includes new registrations as well as adding as additional addresses.
The campaign created over 250 new user accounts, publishing over 1,500 new projects on PyPI, leading to end-user confusion, abuse of resources, and potential security issues.
All relevant projects have been removed from PyPI, and accounts have been disabled.
On April 14, 2025 security@pypi.org was notified of a potential security concern relating to privileges granted to a PyPI User via Organization Teams membership persisting after the User was removed from the PyPI Organization the Team belongs to.
We validated the report as a true finding, identified all cases where this scenario had occurred, notified impacted parties, and released a fix. A full audit determined that all instances were accounted for, with no unauthorized actions taken as a result of the issue.