pypi.org
Python Package Index
@pypi.org
1.5K followers 0 following 17 posts
The Python Package Index (PyPI) is the repository of software for the Python programming language. Pronounced 🥧 🫛 👁️
Posts Media Videos Starter Packs
pypi.org
Python Package Index @pypi.org · 12d
A campaign targeted GitHub Actions to steal PyPI tokens—PyPI wasn’t compromised and no PyPI packages were published by the attackers. Stay safe: review your tokens, rotate any exposed ones, and use short-lived, scoped GitHub Actions tokens. Details:
Token Exfiltration Campaign via GitHub Actions Workflows - The Python Package Index Blog
Incident report of a recent attack campaign targeting GitHub Actions workflows to exfiltrate PyPI tokens, our response, and steps to protect your projects.
blog.pypi.org
4 9
pypi.org
Python Package Index @pypi.org · 15d
🚨 There is a new ongoing phishing campaign against PyPI users. This campaign uses the same tactics as the previous campaign targeting PyPI users, but with a new domain.

Read more about what steps we're taking to protect PyPI users from future campaigns:
Phishing attacks with new domains likely to continue - The Python Package Index Blog
A new phishing campaign targeting PyPI users using similar tactics to previous campaigns.
blog.pypi.org
12 14
Reposted by Python Package Index
python.org
Python Software Foundation @python.org · Aug 26
The PSF has adopted pypistats.org, ensuring long-term stability while staying open source and community driven 🎉 Thank you to Christopher Flynn, for operating this awesome community service for 6+ years- and for continuing to maintain the project 💪🐍 pyfound.blogspot.com/2025/08/pypi...
1 15 31
pypi.org
Python Package Index @pypi.org · Aug 18
PyPI now checks for expired domains to prevent domain resurrection attacks, a type of supply-chain attack where someone buys an expired domain and uses it to take over #PyPI accounts through password resets. #Python #OpenSource #SupplyChain #Security
Preventing Domain Resurrection Attacks - The Python Package Index Blog
PyPI now checks for expired domains to prevent domain resurrection attacks, a type of supply-chain attack where someone buys an expired domain and uses it to take over PyPI accounts through password resets.
blog.pypi.org
7 18
pypi.org
Python Package Index @pypi.org · Aug 7
The Python Package Index is introducing new restrictions to protect Python package installers and inspectors from ZIP confusion attacks. There is no evidence that this vulnerability has been exploited. Read the blog post for more information:
Preventing ZIP parser confusion attacks on Python package installers - The Python Package Index Blog
PyPI will begin warning and will later reject wheels that contain differentiable ZIP features or incorrect RECORD files.
blog.pypi.org
6 16
Reposted by Python Package Index
miketheman.com
Mike Fiedler @miketheman.com · Jul 28
Always verify the domain is pypi.org before logging in.

Read more: blog.pypi.org/posts/2025-0...
PyPI Users Email Phishing Attack - The Python Package Index Blog
PyPI Users are receiving emails detailing them to log in to a fake PyPI site.
blog.pypi.org
6 10
Reposted by Python Package Index
miketheman.com
Mike Fiedler @miketheman.com · Jul 28
Heads Up, #Python Developers!

There is an active phishing attack targeting PyPI users.

• Threat: Emails from [email protected] (with a 'j') link to a fake login page.
• Action: Do not click any links. If you already did, change your PyPI password ASAP.
• Note: PyPI itself has not been breached.
2 40 59
Reposted by Python Package Index
yossarian.net
William Woodruff (1.3.6.1.4.1.55738) @yossarian.net · May 1
my colleague @darkamaul.bsky.social has a new blog post on the @trailofbits.bsky.social blog about how we worked with @pypi.org's maintainers to slash test times on PyPI by over 80%:

blog.trailofbits.com/2025/05/01/m...
Making PyPI's test suite 81% faster
See how we slashed PyPI’s test suite runtime from 163 to 30 seconds. The techniques we share can help you dramatically improve your own project’s testing performance without sacrificing coverage.
blog.trailofbits.com
3 6
pypi.org
Python Package Index @pypi.org · Apr 14
This wasn’t just blather! bsky.app/profile/pypi...
pypi.org
Python Package Index @pypi.org · Feb 21
#PyPI takes security very seriously. If you ever run into malware or a security issue with PyPI itself, make sure to follow our reporting instructions carefully-- and thank you for your vigilance! pypi.org/security/ #python
Security
The Python Package Index (PyPI) is a repository of software for the Python programming language.
pypi.org
1
pypi.org
Python Package Index @pypi.org · Apr 14
Incident report! Thanks to our community for reporting, we take security seriously and work to address issues like these to suit.

blog.pypi.org/posts/2025-0...
Incident Report: Organizations Team privileges - The Python Package Index Blog
We responded to an incident related to privileges persisting via Organization Teams after Members are removed from Organizations.
blog.pypi.org
1 2 3
pypi.org
Python Package Index @pypi.org · Feb 21
#PyPI takes security very seriously. If you ever run into malware or a security issue with PyPI itself, make sure to follow our reporting instructions carefully-- and thank you for your vigilance! pypi.org/security/ #python
Security
The Python Package Index (PyPI) is a repository of software for the Python programming language.
pypi.org
7
pypi.org
Python Package Index @pypi.org · Feb 21
Keep up to date and subscribe for updates on #PyPI infrastructure status, including requests, edge requests/errors, and traffic via our public dashboard: status.python.org #python
Python Infrastructure Status
Welcome to Python Infrastructure's home for real-time and historical data on system performance.
status.python.org
2
pypi.org
Python Package Index @pypi.org · Feb 20
Into stats? Find various first and third party #PyPI statistics on our website: pypi.org/stats/ #python
Statistics
The Python Package Index (PyPI) is a repository of software for the Python programming language.
pypi.org
1
pypi.org
Python Package Index @pypi.org · Feb 20
Want to add your #Python package to #PyPI? Check out our 'Packaging Python Projects' guide:
Packaging Python Projects - Python Packaging User Guide
This tutorial walks you through how to package a simple Python project. It will show you how to add the necessary files and structure to create the package, how to build the package, and how to upload it to the Python Package Index (PyPI).
packaging.python.org
1 5 5
pypi.org
Python Package Index @pypi.org · Feb 20
Learn about how to install and distribute #Python packages with the 'Python Packaging User Guide', a collection of tutorials and references, maintained by the Python Packaging Authority: packaging.python.org/ #pypi
Python Packaging User Guide
The Python Packaging User Guide (PyPUG) is a collection of tutorials and guides for packaging Python software.
packaging.python.org
2
pypi.org
Python Package Index @pypi.org · Feb 19
If you want to get in-depth updates on #PyPI news, updates, and incidents, make sure to regularly read up on our blog: blog.pypi.org/ #python
The Python Package Index Blog
The official blog of the Python Package Index
blog.pypi.org
4 7
pypi.org
Python Package Index @pypi.org · Feb 19
If you've got questions about the basics of #PyPI, your account, integration, project admin, troubleshooting, or what PyPI is all about, make sure to check our FAQ! pypi.org/help/ #python
Help
The Python Package Index (PyPI) is a repository of software for the Python programming language.
pypi.org
1
pypi.org
Python Package Index @pypi.org · Feb 18
@python.org raises and distributes funds to improve #Python's packaging ecosystem, including #PyPI. If your company depends on Python or PyPI, send our sponsorship page to those internal decision makers to help sustain Python for all, for free, forever: www.python.org/sponsors/app...
The official home of the Python Programming Language
www.python.org
5
pypi.org
Python Package Index @pypi.org · Feb 18
New to #PyPI? It's the home and central repository for #Python packages 🐍🏡 Use pip install to grab your favorite libraries!
Installing Packages - Python Packaging User Guide
It’s important to note that the term “package” in this context is being used to describe a bundle of software to be installed (i.e. as a synonym for a distribution). It does not refer to the kind of package that you import in your Python source code (i.e. a container of modules). It is common in the Python community to refer to a distribution using the term “package”. Using the term “distribution” is often not preferred, because it can easily be confused with a Linux distribution, or another larger software distribution like Python itself.
packaging.python.org
1 1
pypi.org
Python Package Index @pypi.org · Feb 18
Welcome to the official #PyPI Bluesky account 🦋🐍 Your trusted source for discovering, installing, and sharing #Python packages. Follow us for updates, security news, and incident reports!
The Python Package Index (PyPI) is a repository of software for the Python programming language.
pypi.org
3 15
Reposted by Python Package Index
snarky.ca
Brett Cannon @snarky.ca · Jan 30
I just went through and archived every project I'm the sole owner of that hasn't had a release in 4 years (although that date isn't special, it just happens to be the "youngest" release; oldest, latest release was over 14 years ago).
pypi.org
Python Package Index @pypi.org · Jan 30
PyPI Now Supports Project Archival: blog.pypi.org/posts/2025-0...
PyPI Now Supports Project Archival - The Python Package Index Blog
Projects on PyPI can now be marked as archived.
blog.pypi.org
1 10
Reposted by Python Package Index
yossarian.net
William Woodruff (1.3.6.1.4.1.55738) @yossarian.net · Jan 30
you can now archive projects on @pypi.org!

this work was done by my teammate Facundo @trailofbits.bsky.social and is part of a larger multi-year arc of work dedicated to landing security and usability improvements on PyPI:

blog.trailofbits.com/2025/01/30/p...
PyPI now supports archiving projects
By Facundo Tuesca PyPI now supports marking projects as archived. Project owners can now archive their project to let users know that the project is not expected to receive any more updates. Projec…
blog.trailofbits.com
7 14
pypi.org
Python Package Index @pypi.org · Jan 30
PyPI Now Supports Project Archival: blog.pypi.org/posts/2025-0...
PyPI Now Supports Project Archival - The Python Package Index Blog
Projects on PyPI can now be marked as archived.
blog.pypi.org
7 20
Reposted by Python Package Index
miketheman.com
Mike Fiedler @miketheman.com · Jan 2
I recently wrote about how I added the ability to quarantine projects under investigation on @pypi.org

Read here: blog.pypi.org/posts/2024-1...

#Python #Packaging #OpenSource #Security #PyPI
Project Quarantine - The Python Package Index Blog
Handling project quarantine lifecycle status for suspected malware
blog.pypi.org
1 8
Reposted by Python Package Index
sethmlarson.dev
Seth Michael Larson @sethmlarson.dev · Dec 11
Last week the Python package "Ultralytics" suffered a supply-chain attack on its build and release process. This is a review of the attack from @pypi.org's perspective.

There's plenty of advice for how Python projects can increase their #security posture:

blog.pypi.org/posts/2024-1...
Supply-chain attack analysis: Ultralytics - The Python Package Index Blog
Analysis of a package targeted by a supply-chain attack to the build and release process
blog.pypi.org
18 40