Python Package Index

The Python Package Index (PyPI) is the repository of software for the Python programming language. Pronounced 🥧 🫛 👁️

[Python Software Foundation @ThePSF]

The PSF is looking for a PyPI Sustainability Engineer to join the team! This is a full time, 1-year contract (with the possibility of renewal), globally remote position. If you love #Python, care about open source, and want your work to matter at infrastructure scale–consider applying! Please boost this post and share with your colleagues and networks. #PyPI #Python

https://t.co/861bLkETob
https://t.co/861bLkETob

[Python Package Index @pypi]

🔎🔐 #PyPI has completed its second external #security audit! Thanks to Sovereign Tech Agency for funding, @trailofbits for the audit, and @AlphaOmegaOSS for supporting rapid remediation. Find the full report on the Trail of Bits publication page. #Python
https://t.co/Gc3Xnhlj75

[Python Package Index @pypi]

PSF Security developers have published incident reports on the LiteLLM & Telnyx #supplychain attacks. Read what happened, who's affected, and what developers & maintainers can do to prepare and protect themselves from future incidents. #security #python
https://t.co/5EJE94JswV

[Python Package Index @pypi]

Over the past year (and a half!), our inaugural PyPI Support Specialist, Maria Ashna, helped tackle backlogs, improve support processes, and keep #PyPI running smoothly for the #Python community.

Read the full reflection on what that work looked like 👇
https://t.co/GAD271r0TM

[Python Package Index @pypi]

2025 was another eventful year for PyPI! Critical security enhancements, powerful new org features, a better overall user experience, and transparent security incident response 🎉👏 Thank you, PyPI team & community!

Learn more on our blog: https://t.co/TFDmZUGFpM

[Python Package Index @pypi]

🚨 New PyPI blog post

TL,DR:
- Trusted Publishing used for 25% of all files uploaded in Oct 2025
- @gitlab Self-Managed now in beta
- Pending Publishers can be added for Organizations, too!

#Python #SupplyChain #Security
https://t.co/ZoXuYF6cPR

[Python Software Foundation @ThePSF]

PyPI serves billions of requests daily- but sustaining it isn’t free. The PSF joined the OpenSSF & others in calling for organizations to invest in sustainable open infrastructure. Learn what this means for #PyPI, the PSF, & how our community can pitch in:
https://t.co/QaIje20Q3O

[Python Package Index @pypi]

A campaign targeted GitHub Actions to steal PyPI tokens—PyPI wasn’t compromised and no PyPI packages were published by the attackers. Stay safe: review your tokens, rotate any exposed ones, and use short-lived, scoped GitHub Actions tokens. Details:
https://t.co/iCajiGM6j1

[Python Package Index @pypi]

🚨 There is a new ongoing phishing campaign against PyPI users. This campaign uses the same tactics as the previous campaign targeting PyPI users, but with a new domain.

Read more about what steps we're taking to protect PyPI users from future campaigns:
https://t.co/94uULky3hV

[Python Software Foundation @ThePSF]

The PSF has adopted https://t.co/w2UhuR4pyR, ensuring long-term stability while staying open source and community driven 🎉 Thank you to Christopher Flynn, for operating this community service for 6+ years- and for continuing to maintain the project 💪🐍 https://t.co/VlIPsIzhvK

[Python Package Index @pypi]

PyPI now checks for expired domains to prevent domain resurrection attacks, a type of supply-chain attack where someone buys an expired domain and uses it to take over #PyPI accounts through password resets. #Python #OpenSource #SupplyChain #Security
https://t.co/mw1NZTIwgp

[Python Package Index @pypi]

The Python Package Index is introducing new restrictions to protect Python package installers and inspectors from ZIP confusion attacks. There is no evidence that this vulnerability has been exploited. Read the blog post for more information:
https://t.co/AnacA4HTSa

[Python Package Index @pypi]

We're happy to share that we've started a #PyPI Bluesky account 🦋🐍 and we welcome you to follow us if you're over there! We will still continue to share announcements here. https://t.co/6bkw05peNu #python
https://t.co/6bkw05peNu

[Python Package Index @pypi]

https://t.co/sAj391YUfF

[Python Package Index @pypi]

https://t.co/GcswDCKUUU

[Vinayak Mehta @vortex_ape]

i'm late to the party but just started using trusted publishing on @pypi and it's such a nice experience!

just create a release.yml on github and add the repo name on the pypi project, that's it!

it's so good to not deal with creating api tokens and putting them on github

[Python Package Index @pypi]

https://t.co/b78BQ9yF7S

[Python Package Index @pypi]

"In 2023, Google’s Open Source Security Team (GOSST) helped to fund the launch of Trusted Publishing for PyPI and supported the rollout of 2FA enforcement across PyPI" 👏👏👏

[Google Open Source @GoogleOSS]

As we look to the future of open source, we're investing in improving security posture of open source projects and ecosystems.

💡 Learn more about our efforts to secure open source supply chains ⬇️ https://t.co/qW0jSZf8Cz

[Python Software Foundation @ThePSF]

Astral is starting a fund to support open source projects and maintainers 💝 Thank you @astral_sh for your support of open source, the PSF, and the #python community, especially @pypi and CPython!
https://t.co/c8Kfmwbfsc

[Python Software Foundation @ThePSF]

Enormous news! the Python Software Foundation now has a 5 year commitment with @fastly to deliver @pypi, https://t.co/UOxg43zVAc, and much more. We appreciate you and your continued investment in the #python community, Fastly! #PyConUS