REVIVAL HIJACK SUPPLY-CHAIN ATTACK THREATENS 22K PYPI PACKAGES

Summary from the TLDR InfoSec newsletter

JFrog has detected a new attack, dubbed Revival Hijack, where attackers register a package under the name of a previously deleted package. 22k packages are vulnerable to this attack because PyPi makes package names available immediately upon deletion. JFrog took action to mitigate this vulnerability by registering packages under the name of more popular vulnerable projects.