🔐 PyPI’s redesigned project pages are live. A new Security tab shows where release files come from, with provenance states, attestations, and warnings. Plus, a rebuilt release files tab. #security#PyPI
Learn more on the PyPI blog:
#PyPI has moved account registration defenses from reactive to proactive. A new email reputation check catches disposable addresses at signup, no manual blocklist updates by staff or volunteers needed. Another step toward a safer ecosystem 🔐 blog.pypi.org/posts/2026-10-…#Python
16.5B requests/day. 13.5 PB served/day. The registry never sleeps. 😴🚫
Made possible by @fastly, who’s donated bandwidth for a decade–thank you!
PyPI is run by @ThePSF, and infrastructure isn’t free. If your team relies on #PyPI, consider sponsoring: pypi.org/sponsors
The #Python Package Index now rejects new files published to releases older than 14 days. This mitigation prevents long-stable releases from being poisoned in case publishing tokens or workflows of #PyPI projects are compromised.
blog.pypi.org/posts/2026-07-…#security#supplychain
🔎🔐 #PyPI has completed its second external #security audit! Thanks to Sovereign Tech Agency for funding, @trailofbits for the audit, and @AlphaOmegaOSS for supporting rapid remediation. Find the full report on the Trail of Bits publication page. #Python
