PyPI improves on checks for the reputation of an email address when used to register an account or add to an existing account, and rejects addresses identified as disposable.
With the new check in place,
outlook.com and hotmail.com addresses can once again be used on PyPI.
For about two weeks in August 2026,
some PyPI users hit intermittent 502 and 503 errors
downloading files from files.pythonhosted.org,
triggering failures during installation from PyPI.
Thanks to our users filing reports in the support tracker;
one report in particular narrowed the problem to a single cache node.
Two separate problems were uncovered. A canary deployment inside Fastly's network had triggered a misconfiguration at one cache node, causing Fastly's routing layer to return 502 responses for traffic reaching the affected cache node. Separately, I found and fixed several bugs in our own Fastly configuration around origin fallback and range request behavior. Those had been there for a while, and only surfaced while digging into these reports.
Both intermittent problems are now fixed, and downloads are back to full function since August 28.
On 2026-08-24 I shipped a change to the configuration that emits PyPI's download logs
so that only requests for actual distribution artifacts are counted.
A request has to end in .whl, .tar.gz, or .zip to produce a download record.
The counts are more accurate now, and existing systems based on PyPI's BigQuery dataset, like pypistats.org will display a different shape going forward.
In 2023 PyPI completed its first security audit, and I am proud to announce that we have now completed our second external security audit.
This work was funded by the Sovereign Tech Agency, a supporter of Open Source security-related improvements, partnering with Trail of Bits to perform the audit. Thanks to ongoing support from Alpha-Omega, my role at the PSF enabled me to focus on rapid remediation of the findings.
This time around, there's no three-part series, as the scope was narrower, focused only on PyPI's codebase and behaviors. Read on for a summary of issues identified, their resolutions, and more details about the audit process.
This post will drill deeper into two recent supply chain exploits, targeting users of popular PyPI packages - litellm & telnyx.
We also provide Python developers and maintainers with guidance on what they can do to prepare
and protect themselves from future incidents.
An attack on the npm ecosystem continues to evolve, exploiting compromised accounts to publish malicious packages. This campaign, dubbed Shai-Hulud, has targeted large volumes of packages in the JavaScript ecosystem, exfiltrating credentials to further propagate itself.
PyPI has not been exploited, however some PyPI credentials were found exposed in compromised repositories. We've revoked these tokens as a precaution, there's no evidence they have been used maliciously. This post raises awareness about the attack and encourages proactive steps to secure your accounts, especially if you're using build platforms to publish packages to PyPI.
Trusted Publishing has proven popular since its launch in 2023.
Recap: Trusted Publishing enables software build platforms to publish packages to PyPI on your behalf, eliminating the need to manage long-lived authentication tokens. After a one-time setup where you delegate publishing authority to your platform, it automatically obtains short-lived, scoped tokens for each build—no manual token management required.
Read the Security Model for a deeper understanding of how Trusted Publishing works.
I recently responded to an attack campaign where malicious actors injected code into GitHub Actions workflows attempting to steal PyPI publishing tokens. PyPI was not compromised, and no PyPI packages were published by the attackers.
Attackers targeted a wide variety of repositories, many of which had PyPI tokens stored as GitHub secrets, modifying their workflows to send those tokens to external servers. While the attackers successfully exfiltrated some tokens, they do not appear to have used them on PyPI.
I've invalidated all affected tokens and notified the impacted project maintainers. If you're one of them, I have emailed you from security@pypi.org.
PyPI now checks for expired domains to prevent domain resurrection attacks, a type of supply-chain attack where someone buys an expired domain and uses it to take over PyPI accounts through password resets.
These changes improve PyPI's overall account security posture, making it harder for attackers to exploit expired domain names to gain unauthorized access to accounts.
Over the past few days, a phishing attack targeting PyPI users via email was uncovered. Our initial report was posted to raise awareness of the attack, and to provide some initial details on the attack vector.
Social media posts linking to the initial report have been shared widely, PyPI itself has not been breached with this attack.
num2words project were uploaded by the attacker, which have since been removed