The PyPI Blog

January 1, 2024
3 min read

2FA Required for PyPI

Two-factor Authentication is required for all users

It's January 1st, 2024, and PyPI now requires Two-factor authentication (2FA) for all users.

This post is a recognition of the hard work that went into making this a reality, and a thank you to all the users who have enabled 2FA on their accounts.

It is also a reminder to those who have not yet enabled 2FA, that you will need to do so before you can perform any management actions, or upload files to PyPI.

Once 2FA is enabled, you may perform management actions, including generating API Tokens or setting up Trusted Publishers (preferred) to upload files.

December 13, 2023
2 min read

2FA Requirement for PyPI begins 2024-01-01

What's changing?

Starting January 1, 2024, all users must enable 2FA for their PyPI accounts.

PyPI has been on the path of being a fully Two-factor Authenticated service a reality, which began in 2019. Read more about some of the steps taken in recent months:

December 6, 2023
1 min read

2FA Enforcement for TestPyPI

What's changing?

Starting today, all users must enable 2FA before they can perform any management actions on TestPyPI.

This change is in preparation for the scheduled enforcement of 2FA on PyPI at the end of 2023.

December 4, 2023
4 min read

Incident Report: User Account Takeover

A PyPI user's account was taken over and used to remove the user's ownership of 4 projects. This was not a malfunction of PyPI or using any vulnerability, rather the user's account was not sufficiently protected against account takeover.

The attacker added themselves as a collaborator to these projects, and removed the original owner. None of the projects had any modifications made to them other than ownership changes.

November 14, 2023
7 min read

Security Audit Remediation: cabotage

This is part three in a three-part series. See part one here, and part two here.

This post is a deeper dive into the remediation of the security audit findings for cabotage - the codebase that deploys PyPI and its supporting services such as conveyor, camo, and inspector.

November 14, 2023
8 min read

Security Audit Remediation: Warehouse

This is part two in a three-part series. See part one here, and part three here.

This post is a deeper dive into the remediation of the security audit findings for the Warehouse - the main codebase for PyPI.org.

The audit report can be found here. I highly recommend reading that for the fullest context first.

November 14, 2023
2 min read

PyPI has completed its first security audit

This is part one in a three-part series. See part two here, and part three here

We are proud to announce that PyPI has completed its first ever external security audit. This work was funded in partnership with the Open Technology Fund (OTF), a previous supporter of security-related improvements to PyPI.

September 18, 2023
7 min read

Inbound Malware Volume Report

Background

The current PyPI security reporting procedure directs reporters to send an email to security@pypi.org with details. security@ was previously an email alias for admin@, a Google Group that contains all current PyPI Administrators (4 people).

August 17, 2023
2 min read

GitHub now scans public issues for PyPI secrets

Back in 2019 we kicked off efforts to integrate with GitHub secret scanning. Due to the complexity in nature, the completed integration launched in 2021, with the volunteer-led effort by Joachim Jablon (@ewjoachim) and the GitHub team.

August 8, 2023
2 min read

2FA Enforcement for New User Registrations

What's changing?

Starting today, newly registered users must enable 2FA before they can perform any management actions on PyPI. This change comes after we've also added a rule for accounts to have a verified, primary email address for the same set of management actions.

As a reminder, PyPI has supported adding 2FA since 2019.