Hackers target Python devs in phishing attacks using fake PyPI site

The Python Software Foundation warned of an active phishing campaign in which threat actors send emails titled '[PyPI] Email verification' linking to a cloned site (pypj.org) that prompts developers to sign in; credentials entered are harvested and may be used to inject malware into existing PyPI packages or publish malicious packages. PyPI has added a homepage banner, urged users to delete the emails and change passwords if compromised, and is working with registrars and CDNs to disrupt the phishing site.