The Python Package Index (PyPI) has issued an urgent warning about an active phishing attack targeting its users through deceptive email verification messages.
## How the Attack Works
Cybercriminals are sending fraudulent emails with the subject line “[PyPI] Email verification” from the suspicious domain noreply@pypj[.]org—note the missing “i” in what should be “pypi[.]org.” These emails direct users to click a verification link that leads to a convincing replica of the legitimate PyPI website.
The attack employs a particularly clever technique: after victims enter their login credentials on the fake site, the request is automatically forwarded to the real PyPI platform. This seamless redirection makes users believe nothing went wrong, while their credentials are secretly captured by attackers.
## Why This Attack Is Dangerous
“This is not a security breach of PyPI itself, but rather a phishing attempt that exploits the trust users have in PyPI,” explained Mike Fiedler, PyPI Admin. The sophisticated approach is harder to detect because it doesn’t generate error messages or failed login attempts that might raise suspicion.
The primary concern extends beyond individual accounts—attackers specifically target users who publish or manage widely-used packages, potentially compromising software used by millions of developers worldwide.
## Immediate Protection Steps
PyPI administrators recommend users take these precautions:
– **Verify URLs carefully** before entering login information
– **Avoid clicking links** in suspicious emails
– **Check domain names letter-by-letter** for typos or variations
– **Use browser extensions** that highlight verified URLs
– **Enable password managers** that only auto-fill on legitimate domains
## If You’ve Been Targeted
Users who may have fallen victim should immediately:
– Change their PyPI password
– Review their account’s Security History for unusual activity
– Monitor their published packages for unauthorized changes
## Broader Security Implications
This campaign mirrors recent attacks on npm (Node Package Manager) that used the typosquatted domain “npnjs[.]com” instead of “npmjs[.]com.” Those attacks successfully compromised seven npm packages and deployed malware called Scavenger Stealer to harvest sensitive browser data.
Similar phishing campaigns have targeted GitHub and other development platforms, highlighting a growing trend of social engineering attacks that exploit developers’ trust in essential tools and automated workflows.
The incident underscores the critical importance of vigilance in the software development ecosystem, where a single compromised account can potentially affect countless downstream users and applications.