Mike Fiedler

Preventing ZIP parser confusion attacks on Python package installers - The Python Package Index Blog PyPI will begin warning and will later reject wheels that contain differentiable ZIP features or incorrect RECORD files.

The Python Package Index is introducing new restrictions to protect Python package installers and inspectors from ZIP confusion attacks. There is no evidence that this vulnerability has been exploited. Read the blog post for more information:

PSF Board Election Nominations Opening July 29th This year’s PSF Board Election nomination period opens next week on Tuesday, July 29th, 2:00 pm UTC and closes on Tuesday, August 12th, 2:00 pm UTC. Who runs for the board? People who care about the Python community, who want to see it flourish and grow, and also have a few hours a month to attend regular meetings, serve on committees, participate in conversations, and promote the Python community. Check out the following resources to learn more about the PSF, as well as what being a part of the PSF Board entails:

🗳️ Nominations for the 2025 PSF Board election are open!

Help shape the future of the PSF — nominate yourself or someone you think would be a great PSF Board Director by Tuesday, August 12th, 2:00 pm UTC.

The PSF has paused our Grants Program Effective August 1st, 2025, the PSF is temporarily pausing our Grants Program after reaching our 2025 grant budget cap earlier than expected. We know how important this program is to many in our community and making this decision was difficult. This is a necessary step to protect both the future of the program and the short- and long-term sustainability of the PSF. (If this moves you immediately to donate to the PSF, we welcome your contributions via our donations page).

The PSF Grants Program has been temporarily paused after hitting our 2025 funding cap early.
It was an extremely difficult but necessary decision to ensure the program and foundation’s near and long term sustainability. Learn more on our blog: pyfound.blogspot.com/2025/08/the-...

Let it never be said that this administration is operating in the interest of the greater good

PyPI Phishing Attack: Incident Report - The Python Package Index Blog Follow-up on the recent phishing attack targeting PyPI users.

Incident Report of the recent #PyPI Phishing Campaign

TL,DR:
• PyPI was not breached
• PyPI users were targeted with phishing emails
• A single project saw uploads with malicious code and those releases have been removed

blog.pypi.org/posts/2025-0...

#Python #OpenSource #Security

Decent guidance for interaction with anyone

I remember when Google did that for JavaScript with Grasshopper before they shut it down. It was fun, and engaging, so I totally would like to see one for Python!

PyPI Users Email Phishing Attack - The Python Package Index Blog PyPI Users are receiving emails detailing them to log in to a fake PyPI site.

Always verify the domain is pypi.org before logging in.

Read more: blog.pypi.org/posts/2025-0...

Heads Up, #Python Developers!

There is an active phishing attack targeting PyPI users.

• Threat: Emails from noreply@pypj.org (with a 'j') link to a fake login page.
• Action: Do not click any links. If you already did, change your PyPI password ASAP.
• Note: PyPI itself has not been breached.

Phishing attack? I just received this email (link deliberately broken): As part of our ongoing account maintenance and security procedures, we’re asking users to verify their email addresses. Please follow [this li...

🚨 Be aware there's a potential phishing campaign targeting #PyPI / #Python package maintainers:

discuss.python.org/t/phishing-a...

Yep. But if you have their orchestration, this can still help.

Maybe another one could examine the other service for vulnerable pattern?

zizmor Static analysis for GitHub Actions

A good tool in the GitHub Actions toolbox is zizmor.
Plenty of audits on permission scopes.
docs.zizmor.sh

Woohoo nicely done!!

PSF Board Election Nominations Opening July 29th This year’s PSF Board Election nomination period opens next week on Tuesday, July 29th, 2:00 pm UTC and closes on Tuesday, August 12th, 2:00 pm UTC. Who runs for the board? People who care about the Python community, who want to see it flourish and grow, and also have a few hours a month to attend regular meetings, serve on committees, participate in conversations, and promote the Python community. Check out the following resources to learn more about the PSF, as well as what being a part of the PSF Board entails:

You can be a part of guiding the future direction of the PSF 🩵🐍💛 Nominate yourself or someone else for the PSF Board for the 2025 election! Nominations open Tuesday, July 29th, 2:00 pm UTC and close Tuesday, August 12th, 2:00 pm UTC. #python

Those are gorgeous, and probably one of the few things that I'm jealous of you outside the city

Thankfully, N > me, and they specialize in analysis and reporting, but it puts extra drain on them and us, cutting into the time better spent on **actual** problems, not your "see? I can poke another hole in a well-known place that allows for holes!" claims.

If you truly want to help, join in.

The impact you have on the ecosystem at large does more harm than good - every time a new "this is for research, don't install this!" project gets uploaded, N amount of other security teams spend resources to review & confirm your garbage, and then escalate to me for further review & removal.

Dear Open Source Supply Chain Security Researchers,

I am glad you get paid to to a job in security, it's very important!

Please please please read the Acceptable Use Policies of services you "attack" - your work puts an ever-increasing drain on already-thin human resources.

Graph titled "TIOBE Programming Community Index" and subtitled "Source: www.tiobe.com", showing difference colored lines rising and falling. The left hand column shows "Ratings %" and the bottom row shows years, 2002 through 2024. Underneath, there is a line listing different programming languages, including Python. Underneath, there is a small chart showing Python as #1 with a rating of 26.98% and an increase of 10.85%.

Python jumped 10%+ on the TIOBE index this month 🤩🐍📈 thanks to the entire #Python community—maintainers, educators, contributors, and users—for helping make Python what it is today!

www.tiobe.com/tiobe-index/

I found @jimgaffigan.bsky.social and wife Jeannie, wandering a pedestrian mall in downtown Jerusalem, and led them to the venue he was trying to find, to perform that night.
I live in NYC

Screenshot from Airplane! movie with words overlaid "We have your clearance, Clarence" "Roger, Roger. What's our vector, Victor?

At AWS Summit NY Keynote, and it's all GenAI or related stuff. All I can hear is this phrase over and over

#AWSSummit #AWSSummitNYC

Affirm Your PSF Membership Voting Status Every PSF voting-eligible Member (Supporting, Contributing, and Fellow) needs to affirm their membership to vote in this year’s election.

We want your vote! Voting-eligible PSF Members (Supporting, Contributing, and Fellow) need to affirm their membership to vote in this year’s Board election to ensure that we meet quorum as required by our Bylaws 🗳️ #python pyfound.blogspot.com/2025/07/affi...

I swear some days you're checking to see if we can discern Al from AI.

Seek out @monorepo.bsky.social who is probably at EuroPython to get some inside track on infra resources used

I'd be curious if you do model PyPI carbon footprint, how you do that and what conclusions you come to!

YouTube video by O'Reilly Velocity NY 2013: Fred Wilson, "Keynote"

Wow, what a trip! I had forgotten about that keynote, just rewatched.

youtu.be/fJOSX-W0yHA?...

Seems still quite relevant, other than Twitter 😉

Do you recall my Velocity 2013 talk? Of course not! 😉
My #1 takeaway for professional self-preservation back then was "Learn code" and it stands true today.

You know when you've been writing too much code when you routinely mistype `calls` as `class`.

Damn muscle memory.

See pypi.org/stats/#:~:te... for what others have done to query stats

PEP 792: Project status markers in the simple index This is the discussion thread for PEP 972: Project status markers in the simple index Draft PEP: PEP 792 – Project status markers in the simple index | peps.python.org Previous thread: Pre-PEP discu...

Follow this discussion: discuss.python.org/t/pep-792-pr...