PyPI supply chain monitoring

Account takeover

An attacker gains control of a PyPI maintainer account through credential phishing or credential stuffing. They publish a new version containing malicious code under the legitimate package name. This is the highest-impact attack class because the malicious version inherits all existing trust from the package.

Typosquatting

An attacker registers a package with a name similar to a popular package (e.g. `requets` instead of `requests`). Users who mistype the package name in `pip install` or `requirements.txt` install the malicious version. PyPI does not block similar-looking names.

Dependency confusion

An attacker discovers an internal package name (through leaked `requirements.txt` files, job postings, or error messages) and publishes a public PyPI package with the same name at a higher version number. Pip resolves the public package over an internal registry if both sources are configured.

CI/CD script injection

A package's `setup.py`, `pyproject.toml` build hooks, or post-install scripts execute arbitrary code during `pip install`. A compromised package can run commands in the CI/CD environment at install time, before the package is ever imported.