Revival Hijack Supply-Chain Attack Compromises 22,000 PyPI Packages, Thousands of Downloads

A new supply chain attack, dubbed 'Revival Hijack,' has compromised over 22,000 removed PyPI packages, spreading malicious code to developers. The attack involves re-registering removed packages with legitimate file names to disguise malware, posing significant risks to DevOps pipelines and thousands of applications. This loophole in PyPI's system has exposed developers to potential security threats, emphasizing the need for heightened vigilance in cybersecurity practices. The attack has already resulted in thousands of downloads of the compromised packages.