The Python Software Foundation warned users this week that threat actors are trying to steal their credentials in phishing attacks using a fake Python Package Index (PyPI) website.

The database containing the compromised passwords was ironically unencrypted and not password-protected itself, a report said.