Python Package Index

PyPI Users Email Phishing Attack - The Python Package Index Blog PyPI Users are receiving emails detailing them to log in to a fake PyPI site.

Always verify the domain is pypi.org before logging in.

Read more: blog.pypi.org/posts/2025-0...

Heads Up, #Python Developers!

There is an active phishing attack targeting PyPI users.

• Threat: Emails from noreply@pypj.org (with a 'j') link to a fake login page.
• Action: Do not click any links. If you already did, change your PyPI password ASAP.
• Note: PyPI itself has not been breached.

Making PyPI's test suite 81% faster See how we slashed PyPI’s test suite runtime from 163 to 30 seconds. The techniques we share can help you dramatically improve your own project’s testing performance without sacrificing coverage.

my colleague @darkamaul.bsky.social has a new blog post on the @trailofbits.bsky.social blog about how we worked with @pypi.org's maintainers to slash test times on PyPI by over 80%:

blog.trailofbits.com/2025/05/01/m...

This wasn’t just blather! bsky.app/profile/pypi...

Incident Report: Organizations Team privileges - The Python Package Index Blog We responded to an incident related to privileges persisting via Organization Teams after Members are removed from Organizations.

Incident report! Thanks to our community for reporting, we take security seriously and work to address issues like these to suit.

blog.pypi.org/posts/2025-0...

Security The Python Package Index (PyPI) is a repository of software for the Python programming language.

#PyPI takes security very seriously. If you ever run into malware or a security issue with PyPI itself, make sure to follow our reporting instructions carefully-- and thank you for your vigilance! pypi.org/security/ #python

Keep up to date and subscribe for updates on #PyPI infrastructure status, including requests, edge requests/errors, and traffic via our public dashboard: status.python.org #python

Statistics The Python Package Index (PyPI) is a repository of software for the Python programming language.

Into stats? Find various first and third party #PyPI statistics on our website: pypi.org/stats/ #python

Want to add your #Python package to #PyPI? Check out our 'Packaging Python Projects' guide:

Learn about how to install and distribute #Python packages with the 'Python Packaging User Guide', a collection of tutorials and references, maintained by the Python Packaging Authority: packaging.python.org/ #pypi

The Python Package Index Blog The official blog of the Python Package Index

If you want to get in-depth updates on #PyPI news, updates, and incidents, make sure to regularly read up on our blog: blog.pypi.org/ #python

Help The Python Package Index (PyPI) is a repository of software for the Python programming language.

If you've got questions about the basics of #PyPI, your account, integration, project admin, troubleshooting, or what PyPI is all about, make sure to check our FAQ! pypi.org/help/ #python

The official home of the Python Programming Language

@python.org raises and distributes funds to improve #Python's packaging ecosystem, including #PyPI. If your company depends on Python or PyPI, send our sponsorship page to those internal decision makers to help sustain Python for all, for free, forever: www.python.org/sponsors/app...

New to #PyPI? It's the home and central repository for #Python packages 🐍🏡 Use pip install to grab your favorite libraries!

The Python Package Index (PyPI) is a repository of software for the Python programming language.

Welcome to the official #PyPI Bluesky account 🦋🐍 Your trusted source for discovering, installing, and sharing #Python packages. Follow us for updates, security news, and incident reports!

I just went through and archived every project I'm the sole owner of that hasn't had a release in 4 years (although that date isn't special, it just happens to be the "youngest" release; oldest, latest release was over 14 years ago).

PyPI now supports archiving projects By Facundo Tuesca PyPI now supports marking projects as archived. Project owners can now archive their project to let users know that the project is not expected to receive any more updates. Projec…

you can now archive projects on @pypi.org!

this work was done by my teammate Facundo @trailofbits.bsky.social and is part of a larger multi-year arc of work dedicated to landing security and usability improvements on PyPI:

blog.trailofbits.com/2025/01/30/p...

PyPI Now Supports Project Archival - The Python Package Index Blog Projects on PyPI can now be marked as archived.

PyPI Now Supports Project Archival: blog.pypi.org/posts/2025-0...

Project Quarantine - The Python Package Index Blog Handling project quarantine lifecycle status for suspected malware

I recently wrote about how I added the ability to quarantine projects under investigation on @pypi.org

Read here: blog.pypi.org/posts/2024-1...

#Python #Packaging #OpenSource #Security #PyPI

Supply-chain attack analysis: Ultralytics - The Python Package Index Blog Analysis of a package targeted by a supply-chain attack to the build and release process

Last week the Python package "Ultralytics" suffered a supply-chain attack on its build and release process. This is a review of the attack from @pypi.org's perspective.

There's plenty of advice for how Python projects can increase their #security posture:

blog.pypi.org/posts/2024-1...