2026-07-15T17:57:50+02:00 https://nostr.ae Python Package Index https://nostr.ae/npub1g52zm7t45x9srp48swy44hc03k2qzkckd63vyqfl0jvnvkzz8n0ql68fy6 https://cdn.fosstodon.org/accounts/avatars/110/460/563/228/175/137/original/3ae1e745c2f1e485.jpg https://cdn.fosstodon.org/accounts/avatars/110/460/563/228/175/137/original/3ae1e745c2f1e485.jpg https://nostr.ae/nevent1qqsrlqgurdz9al7heq7ln662c8l03ggkztm0f3mj0c7k6ecugjw22vszypz3gt0ewksckqvx57pcjkklp7xegq2mzeh29ssp8a7fjdjcgg7dua9dv5s The Python Package Index now rejects new files published to releases older than 14 days. This mitigation prevents long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects are compromised.<br/><br/><a href="https://blog.pypi.org/posts/2026-07-22-releases-now-reject-new-files-after-14-days">https://blog.pypi.org/posts/2026-07-22-releases-now-reject-new-files-after-14-days</a><br/><br/>#python #security #supplychain #pypi 2026-07-22T16:26:28+02:00 https://nostr.ae/nevent1qqsts79cur532sdx3v9xz7000s998cmgnfezunhy4hwg3rw7f7cdejqzypz3gt0ewksckqvx57pcjkklp7xegq2mzeh29ssp8a7fjdjcgg7du4ep5kq 🔎🔐 #PyPI has completed its second external #security audit! Thanks to <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1yng6dx32zrl2qhp2kq26al7uzkwqkugrkaxf4gsycs9r5snrkjdqlznhrk" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Sovereign Tech Agency</span> (<span class="italic">npub1yng…nhrk</span>)</a></span> for funding, <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1rcsevfzqfj6xzk0rajfaftsnq4f4wewydfyxd9u46jch4sxta60qjz7sw8" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Trail of Bits</span> (<span class="italic">npub1rcs…7sw8</span>)</a></span> for the audit, and Alpha-Omega for supporting rapid remediation. Find the full report on the Trail of Bits publication page. #Python<br/><a href="https://blog.pypi.org/posts/2026-04-16-pypi-completes-second-audit/">https://blog.pypi.org/posts/2026-04-16-pypi-completes-second-audit/</a> 2026-04-16T15:26:36+02:00 https://nostr.ae/nevent1qqswfx9a87cfrqxc9xhzl27wpee8an07zp579wvp2747fjajd29pkhqzypz3gt0ewksckqvx57pcjkklp7xegq2mzeh29ssp8a7fjdjcgg7duqmm9vt PSF Security developers have published incident reports on the LiteLLM &amp; Telnyx #supplychain attacks. Read what happened, who&#39;s affected, and what developers &amp; maintainers can do to prepare and protect themselves from future incidents. #security #python<br/><a href="https://blog.pypi.org/posts/2026-04-02-incident-report-litellm-telnyx-supply-chain-attack/">https://blog.pypi.org/posts/2026-04-02-incident-report-litellm-telnyx-supply-chain-attack/</a> 2026-04-02T15:55:49+02:00 https://nostr.ae/nevent1qqsq6fhyzxkhu9h9leqda6sj9jrzcltjvyz6pag35d0twqjsspw5m5szypz3gt0ewksckqvx57pcjkklp7xegq2mzeh29ssp8a7fjdjcgg7duap0j0r RE: <a href="https://mastodon.social/@fastlydevs/116160789779498833">https://mastodon.social/@fastlydevs/116160789779498833</a><br/><br/>Huge thanks to <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub14wasrg0yx5wfw2fkdjnmrkrhxndlsuqppzrn08eg6w8g2ddcssqsldj0zw" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Fastly Devs</span> (<span class="italic">npub14wa…j0zw</span>)</a></span> for 10+ years of keeping #PyPI up and running! PyPI serves 800K+ users at ~100K requests/sec. With a small team behind the service, that kind of scale is only possible because of infrastructure partners who invest in the sustainability of the #Python ecosystem.<blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/note1f6awxhxjcxrxt5s7xqk3wj66mltw0dpx453plq6pxpr0k5rlmausa9hxj4" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">note1f6a…hxj4</a></span><br/> </div> For 10+ years, Fastly has supported the <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1vv848aca8vpv9lt2l2tj6wwehw7drwrs2e3ev9693rwz02jh448qcc6fhk" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Python Software Foundation</span> (<span class="italic">npub1vv8…6fhk</span>)</a></span> in securing and scaling the Python Package Index (PyPI).<br/><br/>~100K req/sec.<br/>500K+ projects.<br/>98–99% cache hit rate.<br/>Real-time purging in milliseconds.<br/>Adaptive WAF protection against bots + account takeovers.<br/><br/>Proud to help keep one of the world’s most critical open source ecosystems fast, fresh, and secure.<br/><br/>Read more: <a href="https://www.fastly.com/customers/psf">https://www.fastly.com/customers/psf</a> <br/><br/>#Python #OpenSource #CyberSecurity<br/><video controls width="100%" class="max-h-[90vh] bg-neutral-300 dark:bg-zinc-700"><source src="https://files.mastodon.social/media_attachments/files/116/160/787/762/104/134/original/5e6eb1bf00ab6018.mp4"></video><br/> </blockquote> 2026-03-03T16:07:17+01:00 https://nostr.ae/nevent1qqsrnz34zphexyd4wumx5gsa7sjdcmgk306ta6tg7k689y9kfnlln9gzypz3gt0ewksckqvx57pcjkklp7xegq2mzeh29ssp8a7fjdjcgg7duak6ax4 Over the past year (and a half!), our inaugural PyPI Support Specialist, Maria Ashna, helped tackle backlogs, improve support processes, and keep #PyPI running smoothly for the #Python community.<br/><br/>Read the full reflection on what that work looked like 👇<br/><a href="https://blog.pypi.org/posts/2026-01-26-a-year-and-a-half-as-inaugural-pypi-support-specialist/?utm_source=chatgpt.com">https://blog.pypi.org/posts/2026-01-26-a-year-and-a-half-as-inaugural-pypi-support-specialist/?utm_source=chatgpt.com</a> 2026-01-28T14:58:03+01:00 https://nostr.ae/nevent1qqsr2emdsw8jr7r7h8re2vvcdkjs98up5xzykwaynscupkcezne5hhqzypz3gt0ewksckqvx57pcjkklp7xegq2mzeh29ssp8a7fjdjcgg7due8c6em 2025 was another eventful year for PyPI! Critical security enhancements, powerful new org features, a better overall user experience, and transparent security incident response 🎉👏 Thank you, PyPI team &amp; community! <br/><br/>Learn more on our blog: <a href="https://blog.pypi.org/posts/2025-12-31-pypi-2025-in-review/">https://blog.pypi.org/posts/2025-12-31-pypi-2025-in-review/</a><br/> <img src="https://cdn.fosstodon.org/media_attachments/files/115/848/842/503/926/210/original/ae67bcf0b1260836.png"> <br/> 2026-01-06T16:24:11+01:00 https://nostr.ae/nevent1qqs9d02asgznaw5avj26nw04mwp09jlg56vmv7nzxuus0089avf5w8czypz3gt0ewksckqvx57pcjkklp7xegq2mzeh29ssp8a7fjdjcgg7duxwp8aj A campaign targeted GitHub Actions to steal PyPI tokens—PyPI wasn’t compromised and no PyPI packages were published by the attackers. Stay safe: review your tokens, rotate any exposed ones, and use short-lived, scoped GitHub Actions tokens. Details:<br/><a href="https://blog.pypi.org/posts/2025-09-16-github-actions-token-exfiltration/">https://blog.pypi.org/posts/2025-09-16-github-actions-token-exfiltration/</a> 2025-09-26T14:45:39+02:00 https://nostr.ae/nevent1qqs0ktxct2vzrnyc4yavl8nfwpj65xyn28ffzexdhpl467gads3l94czypz3gt0ewksckqvx57pcjkklp7xegq2mzeh29ssp8a7fjdjcgg7dutck3ue 🚨 There is a new ongoing phishing campaign against PyPI users. This campaign uses the same tactics as the previous campaign targeting PyPI users, but with a new domain.<br/><br/>Read more about what steps we&#39;re taking to protect PyPI users from future campaigns:<br/><a href="https://blog.pypi.org/posts/2025-09-23-plenty-of-phish-in-the-sea/">https://blog.pypi.org/posts/2025-09-23-plenty-of-phish-in-the-sea/</a> 2025-09-23T18:25:05+02:00 https://nostr.ae/nevent1qqsqejyq07f4dennjye3j9x8cz2240e7kdrtuerqsnk660nscqqa2qszypz3gt0ewksckqvx57pcjkklp7xegq2mzeh29ssp8a7fjdjcgg7dufdnqsn PyPI now checks for expired domains to prevent domain resurrection attacks, a type of supply-chain attack where someone buys an expired domain and uses it to take over #PyPI accounts through password resets. #Python #OpenSource #SupplyChain #Security<br/><a href="https://blog.pypi.org/posts/2025-08-18-preventing-domain-resurrections/">https://blog.pypi.org/posts/2025-08-18-preventing-domain-resurrections/</a> 2025-08-18T19:32:48+02:00 https://nostr.ae/nevent1qqsqjrj7053uae0dcf57v3zvdtjckt58ek3t2rh2kj8urhcuheey44qzypz3gt0ewksckqvx57pcjkklp7xegq2mzeh29ssp8a7fjdjcgg7dug8ug77 The Python Package Index is introducing new restrictions to protect Python package installers and inspectors from ZIP confusion attacks. There is no evidence that this vulnerability has been exploited. Read the blog post for more information:<br/><a href="https://blog.pypi.org/posts/2025-08-07-wheel-archive-confusion-attacks/">https://blog.pypi.org/posts/2025-08-07-wheel-archive-confusion-attacks/</a> 2025-08-07T18:17:04+02:00