Python developers and PyPI users who have received these phishing emails are advised not to click the embedded links and to delete the email immediately. In February, the Python Software Foundation introduced 'Project Archival,' a new system designed to help PyPI publishers archive their projects, indicating to users that no updates are expected. Over the past few days, users who have published projects on PyPI with their email in package metadata may have received an email titled '[PyPI] Email verification' from the email address noreply@pypj.org," the PyPI admin Mike Fiedler cautioned. The Python Software Foundation warned users this week that threat actors are trying to steal their credentials in phishing attacks using a fake Python Package Index (PyPI) website. PyPI was also forced to temporarily suspend user registration and the creation of new projects in March 2024 due to a malware campaign linked to threat actors who uploaded hundreds of new malicious packages masquerading as legitimate projects. "PyPI has not been hacked, but users are being targeted by a phishing attack that attempts to trick them into logging in to a fake PyPI site. However, the attackers are instead harvesting their credentials, which will likely be used in future attacks to infect Python packages they've uploaded to PyPI with malware or to upload new malicious packages onto the platform. The PyPI admins have also added a banner to PyPI's homepage, warning users of this phishing attack, and are now working to find a way to disrupt this ongoing campaign. PyPI is a repository for Python packages, accessible at pypi.org, that offers a centralized platform for developers to distribute and install third-party software libraries. Those who have already entered their credentials on the pypj[.]org phishing site, should immediately change their PyPI password and inspect their accounts' Security History for suspicious or unexpected activity. After opening the malicious website, the targeted users will be prompted to sign in, with the requests sent back to PyPI to trick the users into believing they have logged in to PyPI. "This is not a security breach of PyPI itself, but rather a phishing attempt that exploits the trust users have in PyPI.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 30 Jul 2025 19:00:23 +0000