Tag: domain takeover

2 Attack Reports | 0 Vulnerabilities

Attack reports

Bootstrap script exposes PyPI to domain takeover attacks

A vulnerability in legacy Python packages could enable an attack on PyPI through a domain compromise. The issue stems from bootstrap files for a build tool that installs the 'distribute' package, which fetch and execute an installation script from a now-available domain. Affected packages include t…
supply chain
vulnerability
open-source
pypi
domain takeover
bootstrap script
2025-12-03
python packaging
Published: December 3, 2025
Downloadable IOCs: 0

Build script exposes PyPI to domain takeover attacks

ReversingLabs researchers discovered vulnerable code in legacy Python packages that could enable an attack on the Python Package Index (PyPI) via a domain compromise. The vulnerability lies in bootstrap files for a build tool that installs the Python package 'distribute' and performs other tasks. W…
python
supply chain
vulnerability
pypi
2025-11-24
packaging
legacy code
domain takeover
CVE-2023-45311
bootstrap script
Published: November 24, 2025
Linked vulnerabilities : CVE-2023-45311
Downloadable IOCs: 0
Click here to see more Attack Reports