The Curious Engineer

All blogs / Python

The Python Package Index Blog

blog.pypi.org

The official blog of the Python Package Index

PythonSecurity

’23’24’25’26
Posts
63 from 21 Mar 2023 to 26 Oct 2026
Posting
monthly (17 in the last year)
Kind
project news
Feed
https://blog.pypi.org/feed_rss_created.xml

2026 13

  1. Higher limits for organization projects
  2. PyPI now limits versions to 128 characters
  3. Checking email reputation, and allowing Outlook again
  4. PyPI's developer documentation has moved to dev.pypi.org
  5. Incident Report: File Hosting Errors
  6. Metadata requests no longer tracked in PyPI download counts
  7. How AWS Powers PyPI and the PSF
  8. The HTML representation of the index API is now frozen
  9. Releases now reject new files after 14 days
  10. Planned Updates to the PyPI User Interface
  11. PyPI has completed its second audit
  12. Incident Report: LiteLLM/Telnyx supply-chain attacks, with guidance
  13. Dispatch from PyPI Land: A Year (and a Half!) as the Inaugural PyPI Support Specialist

2025 16

  1. PyPI in 2025: A Year in Review
  2. PyPI and Shai-Hulud: Staying Secure Amid Emerging Threats
  3. New Login Verification for TOTP-based Logins
  4. Trusted Publishing is popular, now for GitLab Self-Managed and Organizations
  5. Phishing attacks with new domains likely to continue
  6. Token Exfiltration Campaign via GitHub Actions Workflows
  7. Preventing Domain Resurrection Attacks
  8. PyPI now serves project status markers in API responses
  9. Preventing ZIP parser confusion attacks on Python package installers
  10. PyPI Users Email Phishing Attack
  11. PyPI Phishing Attack: Incident Report
  12. inbox.ru Domain Prohibition Follow-up
  13. Prohibiting inbox.ru email domain registrations
  14. Incident Report: Organizations Team privileges
  15. Introducing our new Terms of Service
  16. PyPI Now Supports Project Archival

2024 14

  1. Project Quarantine
  2. Supply-chain attack analysis: Ultralytics
  3. Malware Package Analysis: aiocpa
  4. PyPI now supports digital attestations
  5. Safety & Security Engineer: First Year in Review
  6. Incident Report: Leaked GitHub Personal Access Token
  7. Prohibiting Outlook email domains
  8. Expanding Trusted Publisher Support
  9. Malware Distribution and Domain Abuse
  10. Incident Report: Unauthorized User Accounts Access
  11. Announcing a PyPI Support Specialist
  12. Malware Reporting Evolved
  13. 2FA Requirement for PyPI begins 2024-01-01
  14. 2FA Required for PyPI

2023 20

  1. 2FA Enforcement for TestPyPI
  2. Incident Report: User Account Takeover
  3. Security Audit Remediation: cabotage
  4. Security Audit Remediation: Warehouse
  5. PyPI completed its first security audit
  6. Inbound Malware Volume Report
  7. GitHub now scans public issues for PyPI secrets
  8. 2FA Enforcement for New User Registrations
  9. PyPI hires a Safety & Security Engineer
  10. Deprecation of bdist_egg uploads to PyPI
  11. Announcing the launch of PyPI Malware Reporting and Response project
  12. Enforcement of 2FA for upload.pypi.org begins today
  13. Reducing Stored IP Data in PyPI
  14. Securing PyPI accounts via Two-Factor Authentication
  15. PyPI was subpoenaed
  16. Removing PGP from PyPI
  17. Announcing the PyPI Safety & Security Engineer role
  18. Introducing PyPI Organizations
  19. Introducing 'Trusted Publishers'
  20. Welcome to the PyPI Blog