“Three months later, JFrog noticed that the packages in their repository had close to 200,000 downloads from automated scripts and user mistypes.”
Delete a project on PyPI and its name goes back up for grabs. JFrog counts more than 22,000 deleted packages exposed this way, with about 309 more deleted each month. The pingdomv3 name was deleted on March 30 and re-registered the same day, and a later update carried a trojan aimed at Jenkins. JFrog parked empty placeholders on the popular names and still saw close to 200,000 downloads. Build pipelines pull whatever answers to the old name.