Loading story…
The Python Software Foundation invalidated all PyPI tokens stolen in the GhostAction supply chain attack, confirming no malicious packages were published using the compromised credentials. Over 3,300 secrets, including API tokens and credentials across multiple ecosystems, were exfiltrated via malicious GitHub Actions workflows. PyPI maintainers are advised to switch to short-lived Trusted Publishers tokens and review account security.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors launched a phishing campaign targeting Python Package Index (PyPI) users by sending emails that impersonate official communications and direct recipients to a fake login site at pypi-mirror.org. The emails claim to require account verification for maintenance and security, threatening account suspension to coerce users into entering their credentials. The Python Software Foundation (PSF) has warned that compromised credentials could be used to tamper with existing packages or publish malicious ones, potentially impacting the broader Python ecosystem. PSF has advised affected users to reset their passwords, review account security history, and report suspicious activity, while also working to take down malicious domains and strengthen two-factor authentication protections. A similar phishing attempt using the domain pypj.org was observed in July, indicating an ongoing threat to PyPI maintainers and users.
Jun 29, 2026
The Python Software Foundation disclosed a **critical authentication bypass** in the `python.org` release management API that could have let attackers forge administrator-level requests and modify Python release metadata. The flaw, reported by Splitline Ng of DEVCORE and confirmed by the Python Security Response Team, could have enabled changes to download and verification URLs for official Python installers, creating a path to distribute tampered files through trusted `python.org` infrastructure. The vulnerable logic reportedly dated back to 2014, affecting the release pipeline for more than a decade, but maintainers said post-incident forensics found **no evidence of exploitation**. The PSF patched the issue rapidly, with production fixes deployed within 24 hours and broader remediation completed within 48 hours, while also disabling risky API behavior and tightening release controls. Additional hardening included stricter URL validation, mandatory HTTPS enforcement, negative authentication test coverage, longer log retention, and stronger provenance measures around release artifacts, including emphasis on **Sigstore** alongside existing **PGP** signing. A subsequent Trail of Bits review funded by OpenAI reportedly found no additional authentication or authorization flaws, and the Foundation said the changes were designed to reduce the risk of unauthorized modification of Python downloads distributed via official channels.
Jul 12, 2026
Attackers abused trusted open-source distribution channels to publish malicious package updates, including **84 tainted TanStack releases uploaded within six minutes** and a malicious payload discovered in the `Guardrails-AI` package on PyPI. The compromised packages were built to steal credentials from infected developer devices and move laterally to connected systems, highlighting how software supply-chain attacks can rapidly spread through widely used development dependencies. OpenAI confirmed that employee devices were affected by the TanStack incident, giving attackers **limited access** to a small number of internal code repositories. The company said there was **no evidence** that customer data, production systems, intellectual property, or software releases were compromised, and it reported no persistent threat in operational infrastructure. Researchers detected the malicious activity in about 20 minutes, likely constraining the blast radius, while OpenAI rotated cryptographic certificates associated with the affected repositories as part of containment.
Jun 29, 2026