PyPI Phishing Alert: The 3 Simple Steps to Prevent Your Account from Being HACKED and Your Packages Trojanzied

CyberDudeBivash

PyPI Phishing Alert: The 3 Simple Steps to Prevent Your Account from Being HACKED and Your Packages Trojanized

Author: CyberDudeBivash · Secure supply-chain practices for Python publishers

Protect your privacy with Turbo VPN →

Why you’re seeing PyPI phishing right now

Maintainers are being targeted with emails and DMs that pressure them to “verify” or “unlock” their PyPI account. The links open look-alike domains and prompt you to enter your username, password, or API token. Once an attacker steals your credentials, they can take over your project and trojanize future releases for every downstream user.

The 3 steps (do these today)

1) Enable Two-Factor Authentication (2FA)

• Use a security key (WebAuthn/FIDO2) or an authenticator app (TOTP).
• Store backup codes offline; add at least two 2FA methods.
• Turn on any PyPI setting that requires 2FA for sensitive actions (password changes, token creation).

2) Remove long-lived API tokens (prefer Trusted Publishers)

PyPI supports Trusted Publishers using OpenID Connect (OIDC) from CI (e.g., GitHub Actions). This avoids copying a password-like token into CI/CD. If you must use tokens, make them project-scoped, short-lived, and rotate after every release.

# .github/workflows/release.yml
name: Publish to PyPI (Trusted Publisher)
on:
  push:
    tags: [ "v*" ]
permissions:
  id-token: write    # required for OIDC to PyPI
  contents: read
jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.11" }
      - run: pip install build
      - run: python -m build
      - name: Publish
        uses: pypa/gh-action-pypi-publish@release/v1   # no API token needed

Trusted Publisher example: publish without storing long-lived tokens.

3) Don’t bite the bait (anti-phishing habits)

• Only sign in at https://pypi.org — type it or use a bookmark. Avoid look-alike domains.
• Never share credentials or API tokens via web forms or chat. No staff will ask for them.
• Use a password manager, unique passphrase, and enable alerts for new logins or token creation.
• Suspect you clicked? Rotate password & tokens immediately and review recent releases.

Five-minute health check for your project

• ✅ 2FA enabled with a security key + authenticator fallback
• ✅ Publishing via Trusted Publishers or short-lived, project-scoped tokens
• ✅ Release job does not echo secrets; logs are sanitized
• ✅ CI requires code review and tags to publish
• ✅ Offline list of maintainers and emergency rotation steps

If you think you interacted with a phish

1. Rotate your PyPI password and revoke/replace all API tokens (project-scoped, short-lived).
2. Audit the last releases and tags; verify hashes & contents.
3. Notify co-maintainers and downstreams. If trojanization is possible, yank and publish a clean build.
4. Enable 2FA and move to Trusted Publishers to prevent a repeat.

More from CyberDudeBivash

• Your Windows Shortcut is a Trojan Horse: Spot FAKE .LNK files
• Browse label: Windows
• Browse label: Malware
• Browse label: Detection

Join the CyberDudeBivash ThreatWire Newsletter

Get timely threat intelligence, hardening checklists, and a free copy of the Defense Playbook Lite.

Subscribe on LinkedIn

Recommended by CyberDudeBivash

Turbo VPN

Encrypt traffic and protect yourself on public Wi-Fi.

Privacy Multi-platform

Get VPN →

HSBC Premier Banking

Global banking with premium support and secure tools.

Global Premium

Explore →

Tata Neu Super App

Shop, pay, and earn rewards in one app.

Shopping Rewards

Shop Now →

Rewardful

Launch and track a SaaS affiliate program in minutes.

SaaS Affiliate

Start Free →

YES English Program

Improve English for global roles.

Career Skills

Learn →

Disclosure: Some links are affiliate links (Rewardful, HSBC, Tata Neu, Turbo VPN, YES English). We recommend tools that align with our security guidance.

Hashtags:
#CyberDudeBivash #ThreatIntel #SupplyChain #PyPI #Python #Phishing #2FA #WebAuthn #OIDC #TrustedPublisher #CI #DevSecOps #SecureRelease #SecurityKeys