Japan Blames North Korea for PyPI Supply Chain Cyberattack

Japanese authorities warned that the Lazarus Group carried out a typosquatting supply-chain campaign on PyPI by publishing malicious packages (e.g., "pycryptoenv", "pycryptoconf") that install the Comebacker Trojan on Windows systems; the packages were downloaded roughly 300–1,200 times and can enable credential theft, ransomware deployment, and pipeline infiltration, prompting recommendations for stronger package vetting, SCA tools, and platform-level protections.