The Python Package Index (PyPI) team has issued an alert about a phishing campaign targeting users by redirecting them to fake PyPI websites.
Attackers are sending emails with the subject line “[PyPI] Email verification” from a deceptive address: noreply@pypj[.]org. This domain is intentionally designed to look like the legitimate pypi[.]org, tricking recipients into clicking a malicious link.
According to PyPI admin Mike Fiedler, this incident is not a breach of PyPI itself but a phishing scam that exploits user trust in the platform. The emails prompt recipients to verify their email through a link, which leads to a fake site that closely mimics the real PyPI login page to steal credentials.
What makes this attack more sophisticated is its use of a reverse proxy. After users enter their credentials on the fake site, the information is passed to the actual PyPI site, allowing the login to appear successful. Since there are no login errors or unusual messages, users may not realize anything is wrong.
PyPI is actively investigating the issue and considering different ways to mitigate it. Meanwhile, users are advised to double-check website URLs before signing in and avoid clicking on suspicious links.
To stay safe, users can verify the email sender's domain letter by letter and use browser extensions that confirm legitimate URLs. Password managers that auto-fill only on known domains can also help prevent phishing.
If credentials have already been entered on a phishing site, PyPI recommends changing the password immediately and reviewing the account’s security history for suspicious activity.
Though the attacker’s identity remains unknown, the campaign shares similarities with a recent phishing attack on npm. That incident used a fake domain, “npnjs[.]com,” to distribute emails and compromised seven npm packages to spread a malware strain known as Scavenger Stealer. The malware was designed to harvest sensitive browser data and system details using JavaScript payloads and WebSocket connections.
Such attacks have been increasingly observed across software ecosystems like npm and GitHub, where trust and automation are critical. Typosquatting, impersonation, and reverse proxy phishing are all evolving methods used in social engineering tactics that target developers and the tools they rely on.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
