GHSA-2r6g-7r83-jg72: 
Python vulnerability analysis and mitigation

The spam project on PyPI was compromised through a user account takeover via a phishing attack in August 2022. The incident resulted in malicious releases (versions 2.0.2 and 4.0.2) being published to the Python Package Index (PyPI). This security incident was assigned the identifier GHSA-2r6g-7r83-jg72 and was classified as a high-severity vulnerability (GitHub Advisory).

The compromised versions (2.0.2 and 4.0.2) of the spam package contained malicious code designed to collect environment variables and execute malware during the package installation process (PyPA Advisory).

When installed, the compromised versions of the package would collect sensitive environment variables and download and execute malware on the target system, potentially leading to system compromise (GitHub Advisory).

Users should immediately remove any instances of the spam package versions 2.0.2 and 4.0.2 from their systems. No patched versions were released, suggesting users should avoid using this package entirely (GitHub Advisory).

PyPI acknowledged the security incident through their official Twitter account, alerting users about the compromise (PyPI Tweet).