Security News > 2022 > August > PyPI Repository Warns Python Project Maintainers About Ongoing Phishing Attacks

The Python Package Index, PyPI, on Wednesday sounded the alarm about an ongoing phishing campaign that aims to steal developer credentials and inject malicious updates to legitimate packages.

"This is the first known phishing attack against PyPI," the maintainers of the official third-party software repository said in a series of tweets.

The social engineering attack entails sending security-themed messages that create a false sense of urgency by informing recipients that Google is implementing a mandatory validation process on all packages and that they need to click on a link to complete the validation before September, or risk getting their PyPI modules removed.

"These releases have been removed from PyPI and the maintainer accounts have been temporarily frozen," PyPI said.

Developers who believe they may have been compromised should reset their passwords with immediate effect, reset 2FA recovery codes, and review PyPI account logs for anomalous activity.

Earlier this month, researchers from Checkmarx disclosed two malicious Python packages - typing-unions and aiogram-types - that impersonated popular packages typing and aiogram to trick developers into downloading them and infecting their machines with Cobalt Strike.

News URL

https://thehackernews.com/2022/08/pypi-repository-warns-python-project.html