Security News > 2023 > May > PyPI Repository Under Attack: User Sign-Ups and Package Uploads Temporarily Halted

"The volume of malicious users and malicious projects being created on the index in the past week has outpaced our ability to respond to it in a timely fashion, especially with multiple PyPI administrators on leave," the admins said in a notice published on May 20, 2023.

No additional details about the nature of the malware and threat actors involved in publishing those rogue packages to PyPI were disclosed.

The decision to freeze new user and project registrations comes as software registries such as PyPI have proven time and time again to be a popular target for attackers looking to poison the software supply chain and compromise developer environments.

Discover how Deception can detect advanced threats, stop lateral movement, and enhance your Zero Trust strategy.

Earlier this week, Israeli cybersecurity startup Phylum uncovered an active malware campaign that leverages OpenAI ChatGPT-themed lures to bait developers into downloading a malicious Python module capable of stealing clipboard content in order to hijack cryptocurrency transactions.

ReversingLabs, in a similar discovery, identified multiple npm packages named nodejs-encrypt-agent and nodejs-cookie-proxy-agent in the npm repository that drops a trojan called TurkoRat.

News URL

https://thehackernews.com/2023/05/pypi-repository-under-attack-user-sign.html