The Python Package Index now rejects new files published to releases older than 14 days. This mitigation prevents long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects are compromised. blog.pypi.org/posts/2026-0... #python #security #supplychain #pypi

Releases now reject new files after 14 days - The Python Package Index Blog

PyPI no longer allows publishing new files to releases older than 14 days.

blog.pypi.org

Great coverage from @lwndotnet.bsky.social of the PSF PyPI Safety & Security Engineer @miketheman.com's talk on Trusted Publishing at Open Source Summit. 36% of PyPI uploads now use Trusted Publishing. Is yours one of them? lwn.net/Articles/107... #Python #PyPI #OSSumit #Security

Watch PSF PyPI Safety & Security Engineer @miketheman.com's talk from Open Source Summit NA 2026: Trusted Publishing uses OIDC to generate short-lived tokens from CI/CD. No passwords. No tokens to rotate. No secrets in repos. www.youtube.com/watch?v=i0BW... #Python #PyPI #OSSummit #Security

Trusted Publishing: Eliminating Credentials From Your Release Workflow - Mike Fiedler

YouTube video by The Linux Foundation

youtube.com

Hear from PSF's @pypi.org Support Specialist Maria Ashna on what her day-to-day looks like, how she cleared multiple months-long backlogs, and the future of PyPI Orgs in this Behind the Commit episode from @clytaemnestra.bsky.social. ▶️ www.youtube.com/watch?v=OGIz... #Python #PyPI #OpenSource

Inside PyPI: Maria Ashna on Supporting Python's Package Index [Full Episode]

YouTube video by Behind the Commit

youtube.com

Mia Bajić@clytaemnestra.bsky.social · 2mo ago

PyPI hit over 1 million users and it's maintained by a team of just a few people. I talked to Maria Ashna about what that actually looks like: clearing a 500+ ticket backlog, handling edge cases nobody thinks about, and what are PyPI organizations. Episode link is in the first comment.

The PSF is looking for a PyPI Sustainability Engineer to join the team! This is a full time, 1-year contract (with the possibility of renewal), globally remote position. If you love #Python, care about open source, and want your work to matter at infrastructure scale–consider applying! #PyPI #Python

Sustainability Engineer, PyPI - Career Page

Apply to Sustainability Engineer, PyPI in Remote.

pythonsoftwarefoundation.applytojob.com

🔎🔐 PyPI has completed its second external #security audit! Thanks to @sovereign.tech for funding, Trail of Bits for the audit, and Alpha-Omega for supporting rapid remediation. Find the full report on the Trail of Bits publication page. #Python #PyPI

PyPI has completed its second audit - The Python Package Index Blog

We are proud to announce PyPI's second external security audit.

blog.pypi.org

PSF Security developers have published incident reports on the LiteLLM & Telnyx #supplychain attacks. Read what happened, who's affected, and what developers & maintainers can do to prepare and protect themselves from future incidents. #security #python

Incident Report: LiteLLM/Telnyx supply-chain attacks, with guidance - The Python Package Index Blog

Python Package Index shares insights and provides guidance following LiteLLM/Telnyx supply-chain attacks

blog.pypi.org

Huge thanks to @fastly.com for 10+ years of keeping #PyPI up and running! PyPI serves 800K+ users at ~100K requests/sec. With a small team behind the service, that kind of scale is only possible because of infrastructure partners who invest in the sustainability of the #Python ecosystem.

Fastly@fastly.com · 5mo ago

For 10+ years, Fastly has supported the @python.org in securing & scaling the #Python Package Index (PyPI). Proud to help keep one of the world’s most critical open source ecosystems fast, fresh, & secure. www.fastly.com/customers/psf #OpenSource

Over the past year (and a half!), our inaugural PyPI Support Specialist, Maria Ashna, helped tackle backlogs, improve support processes, and keep #PyPI running smoothly for the #Python community. Read the full reflection on what that work looked like 👇 blog.pypi.org/posts/2026-0...

Dispatch from PyPI Land: A Year (and a Half!) as the Inaugural PyPI Support Specialist - The Python Package Index Blog

A look back on the first year and a half as the inaugural PyPI Support Specialist.

blog.pypi.org

Proud to support the Python Software Foundation (@python.org) as a Fast Forward member! PyPI’s 2025 Year in Review shows the scale of the Python ecosystem: • 3.9M+ new files • 130K+ new projects Honored to help power infrastructure behind the global Python community. blog.pypi.org/posts/2025-1...

2025 was another eventful year for PyPI! Critical security enhancements, powerful new org features, a better overall user experience, and transparent security incident response 🎉👏 Thank you, PyPI team & community! Learn more on our blog: blog.pypi.org/posts/2025-1...

New @pypi.org blog TL, DR: - Trusted Publishing used for 25% of all files uploaded in Oct 2025 - @gitlab.com Self-Managed now in beta - Pending Publishers can be added for Organizations, too! #Python #SupplyChain #Security Read it here: blog.pypi.org/posts/2025-1...

Trusted Publishing is popular, now for GitLab Self-Managed and Organizations - The Python Package Index Blog

Expansion of Trusted Publishers feature for more impact

blog.pypi.org

PyPI serves billions of requests daily- but sustaining it isn’t free. The PSF joined the OpenSSF & others in calling for organizations to invest in sustainable open infrastructure. Learn what this means for #PyPI, the PSF, & how our community can pitch in:

Open Infrastructure is Not Free: PyPI, the Python Software Foundation, and Sustainability

In September, the Python Software Foundation (PSF) co-signed the Open Infrastructure is Not Free: A Joint Statement on Sustainable Stewardship Letter published by the Open Source Security Foundation (OpenSSF) as a steward of the Python Package Index (PyPI). As a follow up, I would like to share a bit more about the concerns expressed in this letter as they relate to our community and the PSF.

pyfound.blogspot.com

A campaign targeted GitHub Actions to steal PyPI tokens—PyPI wasn’t compromised and no PyPI packages were published by the attackers. Stay safe: review your tokens, rotate any exposed ones, and use short-lived, scoped GitHub Actions tokens. Details:

Token Exfiltration Campaign via GitHub Actions Workflows - The Python Package Index Blog

Incident report of a recent attack campaign targeting GitHub Actions workflows to exfiltrate PyPI tokens, our response, and steps to protect your projects.

blog.pypi.org

🚨 There is a new ongoing phishing campaign against PyPI users. This campaign uses the same tactics as the previous campaign targeting PyPI users, but with a new domain. Read more about what steps we're taking to protect PyPI users from future campaigns:

Phishing attacks with new domains likely to continue - The Python Package Index Blog

A new phishing campaign targeting PyPI users using similar tactics to previous campaigns.

blog.pypi.org

The PSF has adopted pypistats.org, ensuring long-term stability while staying open source and community driven 🎉 Thank you to Christopher Flynn, for operating this awesome community service for 6+ years- and for continuing to maintain the project 💪🐍 pyfound.blogspot.com/2025/08/pypi...

PyPI now checks for expired domains to prevent domain resurrection attacks, a type of supply-chain attack where someone buys an expired domain and uses it to take over #PyPI accounts through password resets. #Python #OpenSource #SupplyChain #Security

Preventing Domain Resurrection Attacks - The Python Package Index Blog

PyPI now checks for expired domains to prevent domain resurrection attacks, a type of supply-chain attack where someone buys an expired domain and uses it to take over PyPI accounts through password resets.

blog.pypi.org

The Python Package Index is introducing new restrictions to protect Python package installers and inspectors from ZIP confusion attacks. There is no evidence that this vulnerability has been exploited. Read the blog post for more information:

Preventing ZIP parser confusion attacks on Python package installers - The Python Package Index Blog

PyPI will begin warning and will later reject wheels that contain differentiable ZIP features or incorrect RECORD files.

blog.pypi.org

Always verify the domain is pypi.org before logging in. Read more: blog.pypi.org/posts/2025-0...

PyPI Users Email Phishing Attack - The Python Package Index Blog

PyPI Users are receiving emails detailing them to log in to a fake PyPI site.

blog.pypi.org

Heads Up, #Python Developers! There is an active phishing attack targeting PyPI users. • Threat: Emails from noreply@pypj.org (with a 'j') link to a fake login page. • Action: Do not click any links. If you already did, change your PyPI password ASAP. • Note: PyPI itself has not been breached.

my colleague @darkamaul.bsky.social has a new blog post on the @trailofbits.bsky.social blog about how we worked with @pypi.org's maintainers to slash test times on PyPI by over 80%: blog.trailofbits.com/2025/05/01/m...

Making PyPI's test suite 81% faster

See how we slashed PyPI’s test suite runtime from 163 to 30 seconds. The techniques we share can help you dramatically improve your own project’s testing performance without sacrificing coverage.

blog.trailofbits.com

Incident report! Thanks to our community for reporting, we take security seriously and work to address issues like these to suit. blog.pypi.org/posts/2025-0...

Incident Report: Organizations Team privileges - The Python Package Index Blog

We responded to an incident related to privileges persisting via Organization Teams after Members are removed from Organizations.

blog.pypi.org

#PyPI takes security very seriously. If you ever run into malware or a security issue with PyPI itself, make sure to follow our reporting instructions carefully-- and thank you for your vigilance! pypi.org/security/ #python

Security

The Python Package Index (PyPI) is a repository of software for the Python programming language.

pypi.org

Keep up to date and subscribe for updates on #PyPI infrastructure status, including requests, edge requests/errors, and traffic via our public dashboard: status.python.org #python

Into stats? Find various first and third party #PyPI statistics on our website: pypi.org/stats/ #python

Statistics

The Python Package Index (PyPI) is a repository of software for the Python programming language.

pypi.org

Want to add your #Python package to #PyPI? Check out our 'Packaging Python Projects' guide:

Learn about how to install and distribute #Python packages with the 'Python Packaging User Guide', a collection of tutorials and references, maintained by the Python Packaging Authority: packaging.python.org/ #pypi

If you want to get in-depth updates on #PyPI news, updates, and incidents, make sure to regularly read up on our blog: blog.pypi.org/ #python

The Python Package Index Blog

The official blog of the Python Package Index

blog.pypi.org

If you've got questions about the basics of #PyPI, your account, integration, project admin, troubleshooting, or what PyPI is all about, make sure to check our FAQ! pypi.org/help/ #python

Help

The Python Package Index (PyPI) is a repository of software for the Python programming language.

pypi.org

@python.org raises and distributes funds to improve #Python's packaging ecosystem, including #PyPI. If your company depends on Python or PyPI, send our sponsorship page to those internal decision makers to help sustain Python for all, for free, forever: www.python.org/sponsors/app...

The official home of the Python Programming Language

python.org