PyPI: new user and new project registration suspended for about a day as malicious uploads outpace admins (no CVE)
Severity: medium · Patch status: no-fix-needed · Since 2023-05-20
On 2023-05-20 PyPI suspended registration of new users and new project names, saying the volume of malicious users and projects created over the previous week had outpaced its ability to respond in a timely fashion, with several administrators on leave. The notice did not name the accounts or packages or give counts. Existing maintainers could still publish new versions of their projects, and BleepingComputer reports the suspension was lifted on 2023-05-21 at 5:57 PM ET, about a day later. There was no compromise of PyPI itself and no package fix; the effect for consumers is a reminder that new or recently registered package names carry more risk during malware waves. PyPI suspended new-user registration again from 2023-11-24 to 2023-12-04 for a similar reason.
What to do
- Treat packages whose names or maintainers were first registered in the weeks before 2023-05-20 as higher risk and review any added to lockfiles then.
- Use hash-pinned requirements and a vetted internal index or allowlist for new dependencies instead of installing newly published names directly from PyPI.
- Report suspected malicious projects through PyPI's 'Report project as malware' option.
Sources
All live incidents on Threat Watch
