PyPI tackles domain resurrection: Why it matters — and what’s missing

PyPI will automatically invalidate maintainer emails from expired domains to block domain-resurrection account takeovers, reducing supply-chain risk from hijacked packages; the move, already de-verifying ~1,800 addresses with periodic status checks, is a low-friction control that other repos (npm, RubyGems, Maven Central) are urged to adopt. The piece outlines attackers’ favorite package-repo TTPs (account takeover, dependency confusion, typosquatting), notes persistent gaps (account recovery, orphaned projects, weak defaults, opaque ownership transfers), and calls for stronger baselines such as MFA, integrity safeguards, cryptographic signing, and provenance frameworks (SLSA, Sigstore, SBOMs).