Developer account body snatchers pose risks to the software supply chain
Summary: Cisco Talos examined developer account security across NPM, PyPI, CPAN, NuGet and RubyGems, finding that most repositories track developers by email address, so an attacker who controls an expired developer email domain can request password resets and potentially take over the account. Talos found a couple thousand expired developer account domain names at NPM but could not recover the accounts, while CPAN disabled the vulnerable accounts Talos reported; PyPI suffered a real takeover on May 14, 2022, when an attacker replaced the "ctx" package with code that stole environment variables and sent them base64-encoded to a C2 server. Software supply chain attacks more than tripled in 2021 compared with 2020.
Bottom line: A single hijacked maintainer account can push a malicious update to every piece of software that depends on that library, and Talos found thousands of expired developer domains at NPM alone - the same pattern that let an attacker compromise the "ctx" package on PyPI.
Read the original at Cisco Talos ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026