Up to 22,000 PyPI packages may be at risk of being hijacked due to a new technique called 'Revival Hijack', which exploits package name re-registration.
This technique takes advantage of the immediate availability of package names after deletion, allowing attackers to upload malicious packages under those names.
Brian Moussalli from JFrog emphasized that safeguards are limited, with only a warning dialogue available to alert developers about potential consequences of package removal.
As developers have become aware of previous attacks like typosquatting, the effectiveness of such methods has decreased, highlighting the need for vigilance.
[
Collection
]
[
|
...
]