导航|地址|刷新
The Python Package Index Blog

Skip to content

The Python Package Index Blog

The PyPI Blog

Initializing search

GitHub

The Python Package Index Blog

GitHub

The PyPI Blog The PyPI Blog Table of contents
Releases now reject new files after 14 days

Planned Updates to the PyPI User Interface

PyPI has completed its second audit

Incident Report: LiteLLM/Telnyx supply-chain attacks, with guidance

Dispatch from PyPI Land: A Year (and a Half!) as the Inaugural PyPI Support Specialist

PyPI in 2025: A Year in Review

PyPI and Shai-Hulud: Staying Secure Amid Emerging Threats

New Login Verification for TOTP-based Logins

Trusted Publishing is popular, now for GitLab Self-Managed and Organizations

Phishing attacks with new domains likely to continue

Tags

Archive Archive
2026

2025

2024

2023

Authors Authors
Seth Larson

Nicole Harris

Mike Fiedler

Maria Ashna

Dustin Ingram

William Woodruff

Ee Durbin

Facundo Tuesca

Deb Nicholson

Shamika Monahan

Donald Stufft

Table of contents
Releases now reject new files after 14 days

Planned Updates to the PyPI User Interface

PyPI has completed its second audit

Incident Report: LiteLLM/Telnyx supply-chain attacks, with guidance

Dispatch from PyPI Land: A Year (and a Half!) as the Inaugural PyPI Support Specialist

PyPI in 2025: A Year in Review

PyPI and Shai-Hulud: Staying Secure Amid Emerging Threats

New Login Verification for TOTP-based Logins

Trusted Publishing is popular, now for GitLab Self-Managed and Organizations

Phishing attacks with new domains likely to continue

The PyPI Blog

July 22, 2026

2 min read

Releases now reject new files after 14 days

The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days. This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised. As far as we are aware this has not yet been abused, but there is no technical reason beyond that attackers weren't aware it was possible.
Continue reading

July 22, 2026

4 min read

Planned Updates to the PyPI User Interface

Over the next few months, we will be rolling out changes to the PyPI user interface, improving how we surface security signals and updating the pages where users view package details.

Updates will be staged to TestPyPI and deployed to production in phases. This approach allows our team to thoroughly test the UI with production-like data, while providing the community with an opportunity to share feedback.

The first phase of changes is now staged on TestPyPI and ready for users to review!
Continue reading

April 16, 2026

6 min read

PyPI has completed its second audit

In 2023 PyPI completed its first security audit, and I am proud to announce that we have now completed our second external security audit.

This work was funded by the Sovereign Tech Agency, a supporter of Open Source security-related improvements, partnering with Trail of Bits to perform the audit. Thanks to ongoing support from Alpha-Omega, my role at the PSF enabled me to focus on rapid remediation of the findings.

This time around, there's no three-part series, as the scope was narrower, focused only on PyPI's codebase and behaviors. Read on for a summary of issues identified, their resolutions, and more details about the audit process.
Continue reading

April 2, 2026

7 min read

Incident Report: LiteLLM/Telnyx supply-chain attacks, with guidance

This post will drill deeper into two recent supply chain exploits, targeting users of popular PyPI packages - litellm & telnyx. We also provide Python developers and maintainers with guidance on what they can do to prepare and protect themselves from future incidents.
Continue reading

January 26, 2026

2 min read

Dispatch from PyPI Land: A Year (and a Half!) as the Inaugural PyPI Support Specialist

Hello there! I am Maria, the inaugural PyPI Support Specialist. I go by "Thespi-Brain" on GitHub. I wanted to provide a dispatch of how this past year (and a half!) has been regarding my role and PyPI. PyPI has now reached over a million users and has over 700,000 projects. It is, without a doubt, a critical part of the Python ecosystem. As the inaugural PyPI Support Specialist, there were numerous challenges that needed to be tackled regarding PyPI support, such as the ever growing backlog of account recovery and PEP 541 issues.
Continue reading

December 31, 2025

5 min read

PyPI in 2025: A Year in Review

As 2025 comes to a close, it's time to look back at another busy year for the Python Package Index. This year, we've focused on delivering critical security enhancements, rolling out powerful new features for organizations, improving the overall user experience for the millions of developers who rely on PyPI every day, and responding to a number of security incidents with transparency.
Continue reading

November 26, 2025

2 min read

PyPI and Shai-Hulud: Staying Secure Amid Emerging Threats

An attack on the npm ecosystem continues to evolve, exploiting compromised accounts to publish malicious packages. This campaign, dubbed Shai-Hulud, has targeted large volumes of packages in the JavaScript ecosystem, exfiltrating credentials to further propagate itself.

PyPI has not been exploited, however some PyPI credentials were found exposed in compromised repositories. We've revoked these tokens as a precaution, there's no evidence they have been used maliciously. This post raises awareness about the attack and encourages proactive steps to secure your accounts, especially if you're using build platforms to publish packages to PyPI.
Continue reading

November 14, 2025

2 min read

New Login Verification for TOTP-based Logins

We've implemented a new security feature designed to protect PyPI users from phishing attacks: email verification for TOTP-based logins from new devices.
Continue reading

November 10, 2025

5 min read

Trusted Publishing is popular, now for GitLab Self-Managed and Organizations

Trusted Publishing has proven popular since its launch in 2023.

Recap: Trusted Publishing enables software build platforms to publish packages to PyPI on your behalf, eliminating the need to manage long-lived authentication tokens. After a one-time setup where you delegate publishing authority to your platform, it automatically obtains short-lived, scoped tokens for each build—no manual token management required.

Read the Security Model for a deeper understanding of how Trusted Publishing works.
Continue reading

September 23, 2025

2 min read

Phishing attacks with new domains likely to continue

Unfortunately the string of phishing attacks using domain-confusion and legitimate-looking emails continues. This is the same attack PyPI saw a few months ago and targeting many other open source repositories but with a different domain name. Judging from this, we believe this type of campaign will continue with new domains in the future.
Continue reading

12 3..6

Back to top
Next
Tags

Made with Material for MkDocs

------
导航页打开网址