On 2026-08-24 I shipped a change to the configuration that emits PyPI’s download logs so that only requests for actual distribution artifacts are counted. A request has to end in .whl, .tar.gz, or .zip to produce a download record. The counts are more accurate now, and existing systems based onContinue Reading
Working on infrastructure at the Python Software Foundation (PSF) as the Director of Engineering is a broad job with many hats. Python turns up everywhere. It’s in healthcare systems and government agencies, in research labs and classrooms, in one-person side projects and in infrastructure at companies with six-figure headcounts. SomebodyContinue Reading
PyPI has adopted PEP 833, which “freezes” the HTML representation of the index API, which is also sometimes called the “simple API” or the “simple repository API.” New packages and releases will continue to appear in the HTML representation, meaning this has no breaking implications for downstream index consumers. However,Continue Reading
The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days. This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised. As far as we areContinue Reading
Over the next few months, we will be rolling out changes to the PyPI user interface, improving how we surface security signals and updating the pages where users view package details. Updates will be staged to TestPyPI and deployed to production in phases. This approach allows our team to thoroughlyContinue Reading
In 2023 PyPI completed its first security audit, and I am proud to announce that we have now completed our second external security audit. This work was funded by the Sovereign Tech Agency, a supporter of Open Source security-related improvements, partnering with Trail of Bits to perform the audit. ThanksContinue Reading
This post will drill deeper into two recent supply chain exploits, targeting users of popular PyPI packages – litellm & telnyx. We also provide Python developers and maintainers with guidance on what they can do to prepare and protect themselves from future incidents. What happened with LiteLLM and telnyx? AfterContinue Reading
Hello there! I am Maria, the inaugural PyPI Support Specialist. I go by “Thespi-Brain” on GitHub. I wanted to provide a dispatch of how this past year (and a half!) has been regarding my role and PyPI. PyPI has now reached over a million users and has over 700,000 projects.Continue Reading
As 2025 comes to a close, it’s time to look back at another busy year for the Python Package Index. This year, we’ve focused on delivering critical security enhancements, rolling out powerful new features for organizations, improving the overall user experience for the millions of developers who rely on PyPIContinue Reading
An attack on the npm ecosystem continues to evolve, exploiting compromised accounts to publish malicious packages. This campaign, dubbed Shai-Hulud, has targeted large volumes of packages in the JavaScript ecosystem, exfiltrating credentials to further propagate itself. PyPI has not been exploited, however some PyPI credentials were found exposed in compromisedContinue Reading