Package manager

PyPI Configuration

PyPI configuration files can contain package publishing credentials and repository tokens.

Metadata

id: package-manager.pypirc
category: package-manager
sensitivity: critical
subcategory: pypi
artifact types: credential, configuration
tags: pypi, python

Path Matchers

Path	Kind	Platforms
`%USERPROFILE%\.pypirc`	`file`	`windows`
`$HOME/.pypirc`	`file`	`linux`, `macos`

Content Indicators

Literal strings:

username
password
repository

Credential Types

password
api-token

Impact

credential_access

References

Analyzing TeamPCP's Supply Chain Attacks

pip Configuration

pip configuration files can include package index URLs with embedded credentials.

FileZilla Saved Site Credentials

FileZilla saved-site files can contain FTP, FTPS, or SFTP connection details and saved passwords.

On this page

Metadata Path Matchers Content Indicators Credential Types Impact References