PyPI Security Update: Blocking Domain Resurrection Attacks and Account Hijacks

Here's something you may not know if you use Python every day: PyPI just closed down a stealthy loophole that hackers employed to take advantage of. It was called a domain resurrection attack, and the name is more exciting than what it actually did—but the possible harm could have been catastrophic.

What was going on?​

Let me break it down. Developers like to connect their PyPI accounts with emails using custom domains—such as dev@coolproject.net

Then imagine that domain goes to expire. It is done all the time, isn't it? Developer is gone, forgets to renew it, and zap—it's for sale.

Hackers noticed this. They’d buy the old domain, recreate the same email, and simply hit “forgot password” on PyPI. Suddenly, they’re inside someone else’s account. From there, it’s easy to upload a malicious update. And since so many of us install packages without checking, thousands of projects could be hit before anyone noticed.

PyPI’s fix in action​

That's where the new security comes into play. PyPI built protection to keep expired domains from being used for password resets. This is what they're doing:

• Stopping reset emails if the domain it's associated with doesn't look legitimate anymore.
• Watching domain history to make sure ownership hasn't been shifted in a criminal way.
• Flagging flips so PyPI can step in before an attacker can hijack it.

Think of it as a guardian that protects your legacy email address from being used against you.

Why this matters to the community​

You might wonder: "Okay, but why should I care?" Well, considerably. Supply chain attacks are contagious. One hacked account equals thousands of poisoned installs. Even if you code only on weekends, you don't want backdoor malware to find its way into your projects.

Here's why this update is a winner:

• Developers are more secure because their accounts can't be hijacked so easily anymore.
• Users are more confident in packages, since they know that PyPI is watching out for malicious shenanigans.
• Attackers lose an easy vector they've relied on for years.

Closing off​

Ultimately, PyPI preventing domain resurrection attacks is a positive for the world of Python. It plugs a hole that was far too easy to exploit. If you package-keep, go ahead and verify your account information anyway—it can't hurt anything.