'Revival Hijack' on PyPI Disguises Malware With Legitimate File Names

JFrog researchers detail the "Revival Hijack" supply-chain technique on PyPI in which attackers re-register removed package names to push malicious updates; their research found roughly 120,000 reusable names (≈22,000 high-risk packages), demonstrated the attack by publishing benign replacements that nonetheless accumulated ~200,000 downloads, and recommended prohibiting reuse of removed package names and hardening CI/CD workflows.