Why you’re seeing PyPI phishing right now

Maintainers are being targeted with emails and DMs that pressure them to “verify” or “unlock” their PyPI account. The links open look-alike domains and prompt you to enter your username, password, or API token. Once an attacker steals your credentials, they can take over your project and trojanize future releases for every downstream user.

The 3 steps (do these today)

1) Enable Two-Factor Authentication (2FA)

• Use a security key (WebAuthn/FIDO2) or an authenticator app (TOTP).
• Store backup codes offline; add at least two 2FA methods.
• Turn on any PyPI setting that requires 2FA for sensitive actions (password changes, token creation).

2) Remove long-lived API tokens (prefer Trusted Publishers)

PyPI supports Trusted Publishers using OpenID Connect (OIDC) from CI (e.g., GitHub Actions). This avoids copying a password-like token into CI/CD. If you must use tokens, make them project-scoped, short-lived, and rotate after every release.

# .github/workflows/release.yml
name: Publish to PyPI (Trusted Publisher)
on:
  push:
    tags: [ "v*" ]
permissions:
  id-token: write    # required for OIDC to PyPI
  contents: read
jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.11" }
      - run: pip install build
      - run: python -m build
      - name: Publish
        uses: pypa/gh-action-pypi-publish@release/v1   # no API token needed

3) Don’t bite the bait (anti-phishing habits)

• Only sign in at https://pypi.org — type it or use a bookmark. Avoid look-alike domains.
• Never share credentials or API tokens via web forms or chat. No staff will ask for them.
• Use a password manager, unique passphrase, and enable alerts for new logins or token creation.
• Suspect you clicked? Rotate password & tokens immediately and review recent releases.

Five-minute health check for your project

• ✅ 2FA enabled with a security key + authenticator fallback
• ✅ Publishing via Trusted Publishers or short-lived, project-scoped tokens
• ✅ Release job does not echo secrets; logs are sanitized
• ✅ CI requires code review and tags to publish
• ✅ Offline list of maintainers and emergency rotation steps

If you think you interacted with a phish

1. Rotate your PyPI password and revoke/replace all API tokens (project-scoped, short-lived).
2. Audit the last releases and tags; verify hashes & contents.
3. Notify co-maintainers and downstreams. If trojanization is possible, yank and publish a clean build.
4. Enable 2FA and move to Trusted Publishers to prevent a repeat.

More from CyberDudeBivash

• Your Windows Shortcut is a Trojan Horse: Spot FAKE .LNK files
• Browse label: Windows
• Browse label: Malware
• Browse label: Detection

Hashtags:
#CyberDudeBivash #ThreatIntel #SupplyChain #PyPI #Python #Phishing #2FA #WebAuthn #OIDC #TrustedPublisher #CI #DevSecOps #SecureRelease #SecurityKeys