Vulnerable Codes in Legacy Python Packages Enables Attacks on Python Package Index Via Domain Compromise

The report outlines a supply-chain vulnerability in legacy zc.buildout bootstrap scripts that hardcode fetching the now-defunct python-distribute.org; responses from that domain are passed directly to exec() with no integrity checks. ReversingLabs identified affected packages (including slapos.core, pypiserver, and tornado) and demonstrated a proof-of-concept that forces the vulnerable download path, highlighting a domain-takeover vector that could execute arbitrary code when developers run outdated bootstrap scripts or build steps.