Python Package Index

#PyPI has moved account registration defenses from reactive to proactive. A new email reputation check identifies disposable addresses at signup, so protection no longer depends on staff and volunteers manually updating blocklists. Another step toward a safer ecosystem 🔐 #Python

16.5B requests/day. 13.5 PB served/day. The registry never sleeps. 😴🚫 None of it is possible without @fastly.com, who’s donated bandwidth for a decade–thank you! PyPI is run by @thepsf.bsky.social, and infrastructure isn’t free. If your team relies on #PyPI, consider sponsoring: pypi.org/sponsors

I’m excited to speak at @fastly.com #Xcelerate NYC on October 14, joining Artur Bergman, Founder and CTO of #Fastly, on Building a Foundation for the AI Era. We’ll discuss how AI-generated traffic is forcing a rethink of caching, security, and performance at scale.

I wrote up a #PyPI incident report for some install-time issues experienced a few of weeks ago by some users, and what was changed. blog.pypi.org/posts/2026-0...

#PyPI runs on ~zero AWS cost thanks to @fastly.com caching 99% of traffic + @awscloud.bsky.social credits covering the rest. Huge thanks to both! But 2026 broke an 8-year streak: AWS spend is up 69% YoY as agents & CI runs surge. Jacob Coffee on what's changing: pyfound.blogspot.com/2026/08/how-...

The Python Package Index now rejects new files published to releases older than 14 days. This mitigation prevents long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects are compromised. blog.pypi.org/posts/2026-0... #python #security #supplychain #pypi

Great coverage from @lwndotnet.bsky.social of the PSF PyPI Safety & Security Engineer @miketheman.com's talk on Trusted Publishing at Open Source Summit. 36% of PyPI uploads now use Trusted Publishing. Is yours one of them? lwn.net/Articles/107... #Python #PyPI #OSSumit #Security

Watch PSF PyPI Safety & Security Engineer @miketheman.com's talk from Open Source Summit NA 2026: Trusted Publishing uses OIDC to generate short-lived tokens from CI/CD. No passwords. No tokens to rotate. No secrets in repos. www.youtube.com/watch?v=i0BW... #Python #PyPI #OSSummit #Security

Hear from PSF's @pypi.org Support Specialist Maria Ashna on what her day-to-day looks like, how she cleared multiple months-long backlogs, and the future of PyPI Orgs in this Behind the Commit episode from @clytaemnestra.bsky.social. ▶️ www.youtube.com/watch?v=OGIz... #Python #PyPI #OpenSource

The PSF is looking for a PyPI Sustainability Engineer to join the team! This is a full time, 1-year contract (with the possibility of renewal), globally remote position. If you love #Python, care about open source, and want your work to matter at infrastructure scale–consider applying! #PyPI #Python

🔎🔐 PyPI has completed its second external #security audit! Thanks to @sovereign.tech for funding, Trail of Bits for the audit, and Alpha-Omega for supporting rapid remediation. Find the full report on the Trail of Bits publication page. #Python #PyPI

PSF Security developers have published incident reports on the LiteLLM & Telnyx #supplychain attacks. Read what happened, who's affected, and what developers & maintainers can do to prepare and protect themselves from future incidents. #security #python

Huge thanks to @fastly.com for 10+ years of keeping #PyPI up and running! PyPI serves 800K+ users at ~100K requests/sec. With a small team behind the service, that kind of scale is only possible because of infrastructure partners who invest in the sustainability of the #Python ecosystem.

Over the past year (and a half!), our inaugural PyPI Support Specialist, Maria Ashna, helped tackle backlogs, improve support processes, and keep #PyPI running smoothly for the #Python community. Read the full reflection on what that work looked like 👇 blog.pypi.org/posts/2026-0...

Proud to support the Python Software Foundation (@python.org) as a Fast Forward member! PyPI’s 2025 Year in Review shows the scale of the Python ecosystem: • 3.9M+ new files • 130K+ new projects Honored to help power infrastructure behind the global Python community. blog.pypi.org/posts/2025-1...

2025 was another eventful year for PyPI! Critical security enhancements, powerful new org features, a better overall user experience, and transparent security incident response 🎉👏 Thank you, PyPI team & community! Learn more on our blog: blog.pypi.org/posts/2025-1...

New @pypi.org blog TL, DR: - Trusted Publishing used for 25% of all files uploaded in Oct 2025 - @gitlab.com Self-Managed now in beta - Pending Publishers can be added for Organizations, too! #Python #SupplyChain #Security Read it here: blog.pypi.org/posts/2025-1...

PyPI serves billions of requests daily- but sustaining it isn’t free. The PSF joined the OpenSSF & others in calling for organizations to invest in sustainable open infrastructure. Learn what this means for #PyPI, the PSF, & how our community can pitch in:

A campaign targeted GitHub Actions to steal PyPI tokens—PyPI wasn’t compromised and no PyPI packages were published by the attackers. Stay safe: review your tokens, rotate any exposed ones, and use short-lived, scoped GitHub Actions tokens. Details:

🚨 There is a new ongoing phishing campaign against PyPI users. This campaign uses the same tactics as the previous campaign targeting PyPI users, but with a new domain. Read more about what steps we're taking to protect PyPI users from future campaigns:

The PSF has adopted pypistats.org, ensuring long-term stability while staying open source and community driven 🎉 Thank you to Christopher Flynn, for operating this awesome community service for 6+ years- and for continuing to maintain the project 💪🐍 pyfound.blogspot.com/2025/08/pypi...

PyPI now checks for expired domains to prevent domain resurrection attacks, a type of supply-chain attack where someone buys an expired domain and uses it to take over #PyPI accounts through password resets. #Python #OpenSource #SupplyChain #Security

The Python Package Index is introducing new restrictions to protect Python package installers and inspectors from ZIP confusion attacks. There is no evidence that this vulnerability has been exploited. Read the blog post for more information:

Always verify the domain is pypi.org before logging in. Read more: blog.pypi.org/posts/2025-0...

Heads Up, #Python Developers! There is an active phishing attack targeting PyPI users. • Threat: Emails from noreply@pypj.org (with a 'j') link to a fake login page. • Action: Do not click any links. If you already did, change your PyPI password ASAP. • Note: PyPI itself has not been breached.

my colleague @darkamaul.bsky.social has a new blog post on the @trailofbits.bsky.social blog about how we worked with @pypi.org's maintainers to slash test times on PyPI by over 80%: blog.trailofbits.com/2025/05/01/m...

#PyPI takes security very seriously. If you ever run into malware or a security issue with PyPI itself, make sure to follow our reporting instructions carefully-- and thank you for your vigilance! pypi.org/security/ #python

Keep up to date and subscribe for updates on #PyPI infrastructure status, including requests, edge requests/errors, and traffic via our public dashboard: status.python.org #python

Into stats? Find various first and third party #PyPI statistics on our website: pypi.org/stats/ #python

Want to add your #Python package to #PyPI? Check out our 'Packaging Python Projects' guide:

Learn about how to install and distribute #Python packages with the 'Python Packaging User Guide', a collection of tutorials and references, maintained by the Python Packaging Authority: packaging.python.org/ #pypi

If you want to get in-depth updates on #PyPI news, updates, and incidents, make sure to regularly read up on our blog: blog.pypi.org/ #python

If you've got questions about the basics of #PyPI, your account, integration, project admin, troubleshooting, or what PyPI is all about, make sure to check our FAQ! pypi.org/help/ #python

@python.org raises and distributes funds to improve #Python's packaging ecosystem, including #PyPI. If your company depends on Python or PyPI, send our sponsorship page to those internal decision makers to help sustain Python for all, for free, forever: www.python.org/sponsors/app...

New to #PyPI? It's the home and central repository for #Python packages 🐍🏡 Use pip install to grab your favorite libraries!

Welcome to the official #PyPI Bluesky account 🦋🐍 Your trusted source for discovering, installing, and sharing #Python packages. Follow us for updates, security news, and incident reports!

I just went through and archived every project I'm the sole owner of that hasn't had a release in 4 years (although that date isn't special, it just happens to be the "youngest" release; oldest, latest release was over 14 years ago).

you can now archive projects on @pypi.org! this work was done by my teammate Facundo @trailofbits.bsky.social and is part of a larger multi-year arc of work dedicated to landing security and usability improvements on PyPI: blog.trailofbits.com/2025/01/30/p...

PyPI Now Supports Project Archival: blog.pypi.org/posts/2025-0...

I recently wrote about how I added the ability to quarantine projects under investigation on @pypi.org Read here: blog.pypi.org/posts/2024-1... #Python #Packaging #OpenSource #Security #PyPI

Last week the Python package "Ultralytics" suffered a supply-chain attack on its build and release process. This is a review of the attack from @pypi.org's perspective. There's plenty of advice for how Python projects can increase their #security posture: blog.pypi.org/posts/2024-1...