LEGACY PYTHON BOOTSTRAP SCRIPTS CREATE DOMAIN-TAKEOVER RISK IN MULTIPLE PYPI PACKAGES

Summary from the TLDR InfoSec newsletter

Old Python bootstrap scripts in several PyPI packages still reference a long-abandoned domain used to fetch an installer for the legacy Distribute fork of Setuptools. The domain is now for sale. An attacker could buy it and serve malicious code to anyone running those scripts, exposing developers to supply-chain compromise and potential remote takeover via additional malware, such as RATs.