Legacy Python Bootstrap Scripts Enable Domain Takeover Risk in PyPI Packages

Security researchers have identified a vulnerability in legacy Python packages distributed via PyPI, stemming from outdated bootstrap scripts that reference the now-defunct domain python-distribute[.]org. These scripts, associated with the zc.buildout tool, automate the download and installation of dependencies, including the obsolete 'Distribute' package, by fetching installation scripts from the aforementioned domain. Since the domain is currently up for sale and managed for ad revenue, an attacker who acquires it could serve malicious code to any environment executing these legacy bootstrap scripts, potentially compromising the software supply chain.

The affected packages include widely used libraries such as tornado, pypiserver, slapos.core, roman, xlutils, and testfixtures, among others. While the vulnerable code is largely unused in modern development, it may still be present in legacy production environments, posing a latent risk. The issue highlights the ongoing dangers of abandoned infrastructure and the importance of auditing dependencies and installation scripts, especially in open-source ecosystems where legacy code may persist unnoticed.