An abandoned PyPI package (and the phpass Composer package) was taken over and republished to exfiltrate AWS credentials from environment variables.
Demonstrated the risk of dormant-package takeover across ecosystems.
A legitimate package's maintainer account or pipeline was taken over and a malicious version published.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database; a free CI gate that blocks risky dependencies before they merge is coming soon.