PYPI NOW BLOCKS DOMAIN RESURRECTION ATTACKS USED FOR HIJACKING ACCOUNTS

Summary from the TLDR InfoSec newsletter

Accounts of project maintainers publishing software on PyPI are linked to email addresses, which in some cases may be tied to a custom domain name. Historically, attackers have been able to take over some projects by resurrecting an expired domain that was attached to a maintainer's email and resetting the account. PyPI has added new checks that will mark an email as unverified if a domain is expired or is about to expire.