Python Package Index

The Python Package Index (PyPI) is the repository of software for the Python programming language. Pronounced 🥧 🫛 👁️

Blog: https://blog.pypi.org

Last Notes

2026-07-22 16:26:28 CEST

The Python Package Index now rejects new files published to releases older than 14 days. This mitigation prevents long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects are compromised.
https://blog.pypi.org/posts/2026-07-22-releases-now-reject-new-files-after-14-days
#python #security #supplychain #pypi

2026-04-16 15:26:36 CEST

🔎🔐 #PyPI has completed its second external #security audit! Thanks to @npub1yng…nhrk for funding, @npub1rcs…7sw8 for the audit, and Alpha-Omega for supporting rapid remediation. Find the full report on the Trail of Bits publication page. #Python
https://blog.pypi.org/posts/2026-04-16-pypi-completes-second-audit/

2026-04-02 15:55:49 CEST

PSF Security developers have published incident reports on the LiteLLM & Telnyx #supplychain attacks. Read what happened, who's affected, and what developers & maintainers can do to prepare and protect themselves from future incidents. #security #python
https://blog.pypi.org/posts/2026-04-02-incident-report-litellm-telnyx-supply-chain-attack/

2026-03-03 16:07:17 CET

RE: https://mastodon.social/@fastlydevs/116160789779498833
Huge thanks to @npub14wa…j0zw for 10+ years of keeping #PyPI up and running! PyPI serves 800K+ users at ~100K requests/sec. With a small team behind the service, that kind of scale is only possible because of infrastructure partners who invest in the sustainability of the #Python ecosystem.
#note1f6a…hxj4

2026-01-28 14:58:03 CET

Over the past year (and a half!), our inaugural PyPI Support Specialist, Maria Ashna, helped tackle backlogs, improve support processes, and keep #PyPI running smoothly for the #Python community.
Read the full reflection on what that work looked like 👇
https://blog.pypi.org/posts/2026-01-26-a-year-and-a-half-as-inaugural-pypi-support-specialist/?utm_source=chatgpt.com

2026-01-06 16:24:11 CET

2025 was another eventful year for PyPI! Critical security enhancements, powerful new org features, a better overall user experience, and transparent security incident response 🎉👏 Thank you, PyPI team & community!
Learn more on our blog: https://blog.pypi.org/posts/2025-12-31-pypi-2025-in-review/
https://cdn.fosstodon.org/media_attachments/files/115/848/842/503/926/210/original/ae67bcf0b1260836.png

2025-09-26 14:45:39 CEST

A campaign targeted GitHub Actions to steal PyPI tokens—PyPI wasn’t compromised and no PyPI packages were published by the attackers. Stay safe: review your tokens, rotate any exposed ones, and use short-lived, scoped GitHub Actions tokens. Details:
https://blog.pypi.org/posts/2025-09-16-github-actions-token-exfiltration/

2025-09-23 18:25:05 CEST

🚨 There is a new ongoing phishing campaign against PyPI users. This campaign uses the same tactics as the previous campaign targeting PyPI users, but with a new domain.
Read more about what steps we're taking to protect PyPI users from future campaigns:
https://blog.pypi.org/posts/2025-09-23-plenty-of-phish-in-the-sea/

2025-08-18 19:32:48 CEST

PyPI now checks for expired domains to prevent domain resurrection attacks, a type of supply-chain attack where someone buys an expired domain and uses it to take over #PyPI accounts through password resets. #Python #OpenSource #SupplyChain #Security
https://blog.pypi.org/posts/2025-08-18-preventing-domain-resurrections/

2025-08-07 18:17:04 CEST

The Python Package Index is introducing new restrictions to protect Python package installers and inspectors from ZIP confusion attacks. There is no evidence that this vulnerability has been exploited. Read the blog post for more information:
https://blog.pypi.org/posts/2025-08-07-wheel-archive-confusion-attacks/