Legacy Python Bootstrap Scripts Create Domain-Takeover Risk in Multiple PyPI Packages

ReversingLabs discovered vulnerable code in legacy Python packages that could enable supply chain compromise on PyPI through domain takeover attacks. The vulnerability exists in bootstrap files from the zc.buildout automation tool, potentially allowing attackers to compromise multiple PyPI packages through domain hijacking. This represents a significant supply chain security risk for the Python ecosystem, as compromised packages could affect numerous downstream applications and systems.