Python Package Index’s Tweets

Aug 30

You can now include mathematical expressions in your rST or Markdown project description on

. Example here: pypi.org/project/source Thanks to

contributor

@mikefiedler

for implementing this!

9

28

Dustin Ingram

@di_codes

Aug 26

As of this morning, more than 30,000

users have 2FA enabled 🎉 That big bump on the left is the day we announced the security key giveaway (which is still open!) pypi.org/security-key-g

2

25

82

The giveaway will run through Oct 1, at which point the provided discount codes will expire. We’ll be sending emails to eligible maintainers later today to directly inform them as well. More details on the giveaway in this thread:

Quote Tweet

PyPI 2FA Security Key Giveaway

· Jul 8

We’ve begun rolling out a 2FA requirement: soon, maintainers of critical projects must have 2FA enabled to publish, update, or modify them. To ensure that these maintainers can use strong 2FA methods, we're also distributing 4000 hardware security keys! pypi.org/security-key-g

Show this thread

3

6

In light of yesterday’s phishing attack, we have updated the eligibility requirements for our security key giveaway. Any maintainer of a critical project, regardless of whether they already have TOTP-based 2FA enabled, is now eligible:

pypi.org

PyPI is implementing a 2FA requirement for critical projects, and distributing security keys to critical maintainers.

3

35

74

We have additionally determined that the 'deep-translator' project was compromised and deep-translator==1.8.5 was a malicious release.

Quote Tweet

· Aug 24

The malicious releases follow a similar pattern, again using linkedopports[dot]com. At this time, the malicious releases that we are aware of are: - exotel==0.1.6 - spam==2.0.2 and ==4.0.2 We’ve additionally taken down several hundred typosquats that fit the same pattern.

Show this thread

1

17

29

Topics to follow

Sign up to get Tweets about the Topics you follow in your Home timeline.

Carousel

PyPI 2FA Security Key Giveaway

Aug 24

Finally, if you believe you’ve received a phishing email, please contact security@pypi.org with details about the sender email address and URL of the malicious site to help us respond to this issue. And thanks to everyone who reported this attempt!

2

10

48

In order to prevent phishing attacks from succeeding, enable 2FA, ideally using hardware security keys or WebAuthn two-factor authentication: pypi.org/2fa/ PyPI is currently offering free hardware keys for maintainers of the top 1% of projects:

pypi.org

PyPI is implementing a 2FA requirement for critical projects, and distributing security keys to critical maintainers.

1

7

48

To verify that you’re not entering credentials in a phishing site, confirm that the URL in the address bar is pypi.org and that the site’s TLS certificate is issued to pypi.org. Additionally, consider using a browser-integrated password manager.

1

7

41

How to protect yourself: If you believe you may have entered credentials on a phishing site: - reset your password - reset your 2FA recovery codes - review pypi.org/manage/account and pypi.org/manage/account for suspicious activity

1

9

39

What we’re doing: We’re actively reviewing reports of new malicious releases, and ensuring that they are removed and the maintainer accounts restored. We’re also working to provide security features like 2FA more prevalent across projects on PyPI.

3

37

The malicious releases follow a similar pattern, again using linkedopports[dot]com. At this time, the malicious releases that we are aware of are: - exotel==0.1.6 - spam==2.0.2 and ==4.0.2 We’ve additionally taken down several hundred typosquats that fit the same pattern.

3

20

54

We have additionally determined that some maintainers of legitimate projects have been compromised, and malware published as the latest release for those projects. These releases have been removed from PyPI and the maintainer accounts have been temporarily frozen.

2

36

85

When credentials are entered on the phishing site sites[dot]google[dot]com/view/pypivalidate, the data is sent to a URL on the domain linkedopports[dot]com.

2

1

35

The link takes the user to a phishing site mimicking PyPI’s login page, which steals any credentials entered. We are unable to determine whether the phishing site was designed to relay TOTP-based two-factor codes. Accounts protected by hardware security keys are not vulnerable.

2

14

61

Note that PyPI will NEVER remove a valid project from the index. PyPI only removes projects which violate our TOS or are in some way determined to be harmful (e.g., malware).

1

7

76

Background: the phishing message claims that there is a mandatory ‘validation’ process being implemented, and invites users to follow a link to validate a package, or otherwise risk the package being removed from PyPI.

4

24

84

Today we received reports of a phishing campaign targeting PyPI users. This is the first known phishing attack against PyPI. We’re publishing the details here to raise awareness of what is likely an ongoing threat.

20

671

845

We are grateful for

's support of PyPI as a Visionary sponsor of

@thePSF

. Sponsorship funds not only help us maintain what we have but will also help us with future improvements! #thankyou

2

21

Thank you

for supporting PyPI. Through sponsorships and grants,

@thePSF

raised over $300,000 for PyPI’s use. Let’s keep that momentum going! python.org/sponsors/appli

9

24

143

Monitoring: Error rates have returned to baseline, and latencies continue to return to normal across our services. We will continue to monitor as the database upgrades complete and caches re-fill.

Error rates have returned to baseline, and latencies continue to return to normal across our services. We will continue to monitor as the database upgrades complete and caches re-fill.

1

2

4

Monitoring: Our backends have begun to stabilize as the caches are refilled. During the peak of the backend traffic from our CDN we recognized a few bottlenecks in our database layer and have provisioned additional storage IOPs in ord…

Our backends have begun to stabilize as the caches are refilled. During the peak of the backend traffic from our CDN we recognized a few bottlenecks in our database layer and have provisioned...

1

2

Monitoring: Purge All has been issued and we are monitoring as the backends attempt to meet the request volume. We anticipate that the service will continue to stabilize and reach steady state over the next 30-90 minutes.

Purge All has been issued and we are monitoring as the backends attempt to meet the request volume. We anticipate that the service will continue to stabilize and reach steady state over the next...

1

4

Monitoring: In order to resolve an issue in our CDN cache caused by a misconfiguration of Surrogate-Keys, PyPI will need to issue a "Purge All" of our CDN to clear out lingering cached objects that are not accessible to purge individu…

In order to resolve an issue in our CDN cache caused by a misconfiguration of Surrogate-Keys, PyPI will need to issue a "Purge All" of our CDN to clear out lingering cached objects that are not...

1

3

Jul 28

We published a postmortem on our July 28th incident:

PyPI Outage 2022-07-28 18:46-18:53 UTC

1

6

Support from organizations like Qube Research & Technologies Limited help keep PyPI running and allow us to continually keep improving it. Thank you, thank you! Head to Linkedin and connect with QRT: bit.ly/3iAqF5g

4

Thank you to

for financially supporting PyPI through

@thePSF

’s sponsorship program. Every sponsorship has an impact on PyPI’s sustainability and maintenance. Considering being a sponsor? Email sponsors@python.org

1

10

We truly appreciate

for demonstrating their support of PyPI by becoming a Maintaining sponsor. Their generosity ensures that we can improve and sustain PyPI for many generations to come - thank you!

8

PyPI 2FA Security Key Giveaway

Jul 8

PS: If you're trying to redeem your code and getting 'Promo code doesn't apply', increase your quantity in the cart from 1 key to 2 keys! Our intention is for everyone to be able to have a secondary backup key in addition to their primary key.

1

11

40

Ensuring that the most widely used projects have these protections against account takeover is one step towards our wider efforts to improve the general security of the Python ecosystem for all PyPI users. You can track our progress on our dashboard: p.datadoghq.com/sb/7dc8b3250-3

1

8

38

We've also enabled a feature that will allow any project to opt-in to a 2FA requirement for its maintainers: this can be enabled in the settings for each individual project. This can be enabled/disabled for non-critical projects at any time.

2

3

34

Who's eligible? Project eligibility is based on downloads: any project in the top 1% of downloads over the prior 6 months is designated as critical (as well as PyPI's own dependencies). Today, we’ve notified maintainers of those projects via email. But that's not all!

3

12

46

We’ve begun rolling out a 2FA requirement: soon, maintainers of critical projects must have 2FA enabled to publish, update, or modify them. To ensure that these maintainers can use strong 2FA methods, we're also distributing 4000 hardware security keys!

pypi.org

PyPI is implementing a 2FA requirement for critical projects, and distributing security keys to critical maintainers.

16

300

770