PyPI supply chain monitoring

Account takeover

An attacker gains control of a PyPI maintainer account through credential phishing or credential stuffing. They publish a new version containing malicious code under the legitimate package name. This is the highest-impact attack class because the malicious version inherits all existing trust from the package.

Typosquatting

An attacker registers a package with a name similar to a popular package (e.g. `requets` instead of `requests`). Users who mistype the package name in `pip install` or `requirements.txt` install the malicious version. PyPI does not block similar-looking names.

AI-hallucinated package names

Coding agents invent plausible package names that do not exist, or conflate two real packages into one (slopsquatting). Attackers and defenders race to claim those names. Attestd flags the invented name via the typosquat signal with kind hallucination and returns the packages the requester likely meant.

Dependency confusion

An attacker discovers an internal package name (through leaked `requirements.txt` files, job postings, or error messages) and publishes a public PyPI package with the same name at a higher version number. Pip resolves the public package over an internal registry if both sources are configured.

CI/CD script injection

A package's `setup.py`, `pyproject.toml` build hooks, or post-install scripts execute arbitrary code during `pip install`. A compromised package can run commands in the CI/CD environment at install time, before the package is ever imported.