An abandoned PyPI package (and the phpass Composer package) was taken over and republished to exfiltrate AWS credentials from environment variables.
Demonstrated the risk of dormant-package takeover across ecosystems.
A legitimate package's maintainer account or pipeline was taken over and a malicious version published.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database, or add the free CI gate to block risky dependencies before they merge.