PyPI Fixes High-Severity Access Control Issues Found in Security Audit

What Happened

Security researchers recently audited PyPI, the main repository for Python software packages, and found several serious security flaws. The most critical issues allowed regular users to secretly give themselves administrative control over organizations or keep their access to projects even after those projects were transferred away. While PyPI has fixed most of these problems, one remaining issue allows attackers to hide malicious software dependencies in a way that security tools might miss. Organizations using Python should ensure their security tools check the actual package files, not just the online registry information.

Key Takeaways

• PyPI patched a high-severity flaw allowing organization members to invite new owners due to insufficient POST request permission checks.
• A second high-severity issue allowed stale team permissions to persist after project transfers, potentially enabling unauthorized malicious uploads.
• A medium-severity JWT replay vulnerability existed due to a 25-second discrepancy between Redis key expiration and PyJWT's leeway window.
• An unpatched metadata validation gap allows attackers to hide malicious dependencies inside wheel metadata that differ from the PyPI JSON API.

Affected Systems

• PyPI (Python Package Index)
• Warehouse (PyPI application)
• pip (package installer)
• SBOM generators relying on PyPI JSON API

Attack Chain

In a theoretical attack leveraging the metadata gap, an adversary uploads a Python package to PyPI declaring no dependencies in the upload form. However, the attacker embeds a malicious dependency requirement directly inside the wheel archive's metadata file. Security tools querying the PyPI JSON API report zero dependencies, but when a victim installs the package using pip, the installer fetches the embedded metadata and silently installs the malicious dependency.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

No specific detection rules are provided, but Trail of Bits developed a custom CodeQL query for PyPI to detect state-changing POST handlers protected only by read-level permissions.

Detection Engineering Assessment

EDR Visibility: None — The vulnerabilities are server-side logic flaws within the PyPI infrastructure and do not execute on endpoint devices. Network Visibility: Low — Traffic to PyPI is TLS-encrypted, making network-level inspection of API payloads or wheel metadata difficult without SSL decryption. Detection Difficulty: Hard — Detecting these issues requires access to PyPI's internal backend logs or custom tooling to compare PyPI JSON API responses against downloaded wheel metadata.

Required Log Sources

• Application Audit Logs
• Web Server Access Logs
• CI/CD Pipeline Logs

Hunting Hypotheses

Hypothesis	Telemetry	ATT&CK Stage	FP Risk
Compare dependency lists from the PyPI JSON API against the embedded .dist-info/METADATA in downloaded wheel files to identify hidden malicious dependencies.	Package Manager Logs / Custom Scripting	Execution / Supply Chain	Low

Control Gaps

• SBOM generators relying solely on PyPI JSON API
• Vulnerability scanners not parsing embedded wheel metadata

Key Behavioral Indicators

• Discrepancies between form-derived metadata and embedded wheel metadata
• Unexpected role changes in PyPI organization audit logs

False Positive Assessment

• Low

Recommendations

Immediate Mitigation

• Audit internal Python projects for unexpected dependencies installed during the build process.
• Ensure SBOM generation tools parse actual wheel metadata rather than relying solely on the PyPI JSON API.

Infrastructure Hardening

• Review PyPI organization roles and project permissions to ensure no unauthorized or stale access exists.
• Implement strict lockfiles with hash-checking for all Python dependency installations.

User Protection

• Educate developers on the risks of hidden dependencies in Python packages.
• Monitor CI/CD pipelines for leaked OIDC tokens or misconfigured artifacts.

Security Awareness

• Train engineering teams on the nuances of package registry metadata and the potential for supply chain compromise.

MITRE ATT&CK Mapping

• T1098 - Account Manipulation
• T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain
• T1550.001 - Use Alternate Authentication Material: Application Access Token