https://www.bleepingcomputer.com/news/security/pypi-announces-mandatory-use-of-2fa-for-all-software-publishers/ BleepingComputer.com logo * * * * [ ] [Login] [Sign up] * * * * [ ] [Login] [Sign up] * News + Featured + Latest + Barracuda zero-day abused since 2022 to drop new malware, steal data Barracuda zero-day abused since 2022 to drop new malware, steal data + Android apps with spyware installed 421 million times from Google Play Android apps with spyware installed 421 million times from Google Play + Microsoft finds macOS bug that lets hackers bypass SIP root restrictions Microsoft finds macOS bug that lets hackers bypass SIP root restrictions + New hacking forum leaks data of 478,000 RaidForums members New hacking forum leaks data of 478,000 RaidForums members + WordPress force installs critical Jetpack patch on 5 million sites WordPress force installs critical Jetpack patch on 5 million sites + Barracuda zero-day abused since 2022 to drop new malware, steal data Barracuda zero-day abused since 2022 to drop new malware, steal data + WordPress plugin 'Gravity Forms' vulnerable to PHP object injection WordPress plugin 'Gravity Forms' vulnerable to PHP object injection + Microsoft finds macOS bug that lets hackers bypass SIP root restrictions Microsoft finds macOS bug that lets hackers bypass SIP root restrictions * Downloads + Latest + Most Downloaded + Qualys BrowserCheck Qualys BrowserCheck + STOPDecrypter STOPDecrypter + AuroraDecrypter AuroraDecrypter + FilesLockerDecrypter FilesLockerDecrypter + AdwCleaner AdwCleaner + ComboFix ComboFix + RKill RKill + Junkware Removal Tool Junkware Removal Tool * VPNs + Popular + Best VPNs Best VPNs + How to change IP address How to change IP address + Access the dark web safely Access the dark web safely + Best VPN for YouTube Best VPN for YouTube * Virus Removal Guides + Latest + Most Viewed + Ransomware + Remove the Theonlinesearch.com Search Redirect Remove the Theonlinesearch.com Search Redirect + Remove the Smartwebfinder.com Search Redirect Remove the Smartwebfinder.com Search Redirect + How to remove the PBlock+ adware browser extension How to remove the PBlock+ adware browser extension + Remove the Toksearches.xyz Search Redirect Remove the Toksearches.xyz Search Redirect + Remove Security Tool and SecurityTool (Uninstall Guide) Remove Security Tool and SecurityTool (Uninstall Guide) + How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo + How to remove Antivirus 2009 (Uninstall Instructions) How to remove Antivirus 2009 (Uninstall Instructions) + How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller + Locky Ransomware Information, Help Guide, and FAQ Locky Ransomware Information, Help Guide, and FAQ + CryptoLocker Ransomware Information Guide and FAQ CryptoLocker Ransomware Information Guide and FAQ + CryptorBit and HowDecrypt Information Guide and FAQ CryptorBit and HowDecrypt Information Guide and FAQ + CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ * Tutorials + Latest + Popular + How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 + How to use the Windows Registry Editor How to use the Windows Registry Editor + How to backup and restore the Windows Registry How to backup and restore the Windows Registry + How to open a Windows 11 Command Prompt as Administrator How to open a Windows 11 Command Prompt as Administrator + How to start Windows in Safe Mode How to start Windows in Safe Mode + How to remove a Trojan, Virus, Worm, or other Malware How to remove a Trojan, Virus, Worm, or other Malware + How to show hidden files in Windows 7 How to show hidden files in Windows 7 + How to see hidden files in Windows How to see hidden files in Windows * Deals + Categories + eLearning eLearning + IT Certification Courses IT Certification Courses + Gear & Gadgets Gear + Gadgets + Security Security * Forums * More + Startup Database + Uninstall Database + Glossary + Chat on Discord + Send us a Tip! + Welcome Guide * Home * News * Security * PyPI announces mandatory use of 2FA for all software publishers * * PyPI announces mandatory use of 2FA for all software publishers By Bill Toulas * May 28, 2023 * 10:09 AM * 0 PyPI The Python Package Index (PyPI) has announced that it will require every account that manages a project on the platform to have two-factor authentication (2FA) turned on by the end of the year. PyPI is a software repository for packages created in the Python programming language. The index hosts 200,000 packages, allowing developers to find existing packages that satisfy various project requirements, saving them time and effort. The PyPI team says the decision to make 2FA mandatory on all accounts is part of their long-term commitment to enhancing security on the platform, complementing previous measures taken in that direction, like blocking compromised credentials and supporting API tokens. One benefit of 2FA protection is the reduced risk of supply chain attacks. These types of attacks occur when a malicious actor gains control of the account of a software maintainer and adds a backdoor or malware to a package used as a dependency in various software projects. Depending on how popular the package is, such attacks can impact millions of users. While developers are responsible for thoroughly inspecting their project's building blocks, PyPI's measure should make it easier to minimize this type of problem. Additionally, the Python project repository has suffered from rampant malware uploads, famous package impersonation, and the re-submission of malicious code using hijacked accounts in the past months. The problem reached such a magnitude that PyPI last week had to temporarily pause registrations of new users and projects until an effective defense solution could be developed and implemented. 2FA protection will help mitigate the problem of account takeover attacks and should also set a limit on how many new accounts a suspended user can create to re-upload malicious packages. Road to 2FA The requirement to set up 2FA on all project and organization maintainer accounts has the deadline to the end of 2023. In the following months, impacted users are recommended to prepare and enable the additional security measure using either a hardware key or an authentication app. "The most important things you can do to prepare are to enable 2FA for your account as soon as possible, either with a security device (preferred) or an authentication app, and to switch to using either Trusted Publishers (preferred) or API tokens to upload to PyPI." - PyPI The PyPI team says the preparatory work it has done in previous months, like introducing 'Trusted Publishing,' combined with parallel initiatives from platforms like GitHub that have helped developers familiarize themselves with 2FA requirements, make this year an excellent moment to introduce the measure. Related Articles: Google Authenticator now backs up your 2FA codes to the cloud PyPI temporarily pauses new users, projects amid high volume of malware Google will add End-to-End encryption to Google Authenticator WhatsApp boosts defense against account takeover via malware Hackers compromise 3CX desktop app in a supply chain attack * 2FA * Account * PyPI * Python * Security * Supply Chain * Supply Chain Attack * Two-factor Authentication * * * * * Bill Toulas Bill Toulas is a technology writer and infosec news reporter with over a decade of experience working on various online publications. An open source advocate and Linux enthusiast, is currently finding pleasure in following hacks, malware campaigns, and data breach incidents, as well as by exploring the intricate ways through which tech is swiftly transforming our lives. * Previous Article * Next Article Post a Comment Community Rules You need to login in order to post a comment [Login] Not a member yet? Register Now You may also like: [INS::INS] Popular Stories * compressed folder zip archive Clever 'File Archiver In The Browser' phishing trick uses ZIP domains * RaidForums New hacking forum leaks data of 478,000 RaidForums members Follow us: * * * * * Main Sections * News * VPN Buyer Guides * Downloads * Virus Removal Guides * Tutorials * Startup Database * Uninstall Database * Glossary Community * Forums * Forum Rules * Chat Useful Resources * Welcome Guide * Sitemap Company * About BleepingComputer * Contact Us * Send us a Tip! * Advertising * Write for BleepingComputer * Social & Feeds * Changelog Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2023 Bleeping Computer^(r) LLC - All Rights Reserved Login Username [ ] Password [ ] [*] Remember Me [ ] Sign in anonymously [Login] Sign in with Twitter button Sign in with Twitter --------------------------------------------------------------------- Not a member yet? Register Now Reporter Help us understand the problem. What is going on with this comment? * ( )Spam * ( )Abusive or Harmful * ( )Inappropriate content * ( )Strong language * ( )Other [ ] * [ ] Read our posting guidelinese to learn what content is prohibited. Submitting... SUBMIT