The Python Software Foundation warned users of a new string of phishing attacks using a phony Python Package Index (PyPI) website and asking victims to verify their account or face suspension, and advised anyone who did provide their credentials to change their password "immediately." PyPI is extremely widely used, hosting over 681,400 projects and more than 15 million files, making it a target for a massive supply chain attack along the lines of the two npm attacks earlier this month. The foundation's security developer-in-residence Seth Larson on Tuesday said the latest phish, sent via email, asks PyPI users to "verify their email address" for "account maintenance and security procedures." Failing to do so, it says, may result in a suspended account. "This email is fake, and the link goes to pypi-mirror.org which is a domain not owned by PyPI or the PSF," Larson warned via the PyPI blog. The worry here is that a developer would fall for the phish and enter their credentials into the fake domain, thus handing their credentials over to the criminals and enabling them to hijack legitimate PyPI accounts owned by the same developer. With this access, miscreants could inject malware into the compromised maintainer's existing Python packages, or even publish entirely new malicious ones, which would then run on users' machines and be capable of stealing secrets, credentials, cryptocurrency wallets, and other sensitive data. "If you have already clicked on the link and provided your...
New string of phishing attacks targets Python developers
The Register
·Jessica Lyons
·Published Sep 24, 2025
·Updated
Affected Software
1 affected component
Python Software Foundation Python Package Index
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses recent phishing attacks targeting Python developers via a fake Python Package Index (PyPI) website.
2
What security implications are discussed in relation to the phishing attacks?
The phishing attacks pose a risk of account compromise for developers who are tricked into providing their credentials.
3
What steps does the Python Software Foundation recommend for affected users?
The Python Software Foundation advises users to be cautious and verify any suspicious communications, especially regarding their accounts.
4
Who are the primary victims of these phishing attacks?
The primary victims of these attacks are Python developers who actively use the Python Package Index.
5
What should users do if they have already submitted their credentials?
Users who have submitted their credentials should immediately change their passwords and monitor their accounts for any suspicious activity.