PyPI Blog

I'm really not following -- why does the ban specifically focus on a single domain instead of attempting to solve the core issue? Do the maintainers not know that accounts for any big email provider (gmail, outlook, you name it) can be bought or created for very, very cheap. Which is obviously what the attackers will now do after this ban. The blog post references [0] which makes it seem like the maintainers do, in fact, just ban any email providers that attackers use instead of trying to solve the issue. [0] https://blog.pypi.org/posts/2024-06-16-prohibiting-msn-emails/

> Has anyone implemented this end-to-end? Yes; I (along with a bunch of other fantastic folks) implemented it end-to-end for both Homebrew[1] and PyPI[2]. This is at a "lower" level than most corporate uses, however: the goal with integrating Sigstore into these OSS ecosystems is not to build up complex verifiable policies (which OSS maintainers don't want to deal with), but to enable signing with misuse-resistant machine identities. [1]: https://blog.trailofbits.com/2023/11/06/adding-build-provenance-to-hom… [2]: https://blog.pypi.org/posts/2024-11-14-pypi-now-supports-digital-attes…

This feels like a slippery slope fallacy. I don’t trust Microsoft and don’t think they have user’s best interests at heart, but 2FA is generally accepted as a positive thing industry-wide. They’re far from the only ones to require it. See for example PyPI. https://blog.pypi.org/posts/2024-01-01-2fa-enforced/ npm is another one, but because it’s owned by GitHub (and thus Microsoft) we can leave it out of the argument.

Why does one person have admin on all those repos? Why is Python still running any classic access tokens? Why is the access token EVER in the source code? What other stuff is “running on their laptop”? No pass! People with access to the repos shouldn’t also have access to push bits to the world. It puts those people with that access in grave physical danger. Edit, https://blog.pypi.org/posts/2024-07-08-incident-report-leaked-admin-pe… This token has been in the wild for 15 months! The JFrog post cannot say that disaster was averted because we do not know.

> Claude’s version is pretty close to the blob-util version (unsurprising, since it was probably trained on it!). AI are thieves! > I don’t know which direction we’re going in with AI (well, ~80% of us; to the remaining holdouts, I salute you and wish you godspeed!), but I do think it’s a future where we prize instant answers over teaching and understanding. Google ruined its search engine years ago before AI already. The big problem I see is that we have become WAY too dependent on these mega-corporations. Which browser are people using? Typically chrome. An evil company writes the code. And soon it will fire the remaining devs and replace them with AI. Which is kind of fitting. > Even now there’s a movement toward putting documentation in an llms.txt file, so you can just point an agent at it and save your brain cells the effort of deciphering English prose. (Is this even documentation anymore? What is documentation?) Documentation in general sucks. But documentation is also a hard problem. I love examples. Small snippets. FAQs. Well, many projects barely have these. Look at ruby webassembly/wasm or ruby opal. Their documentation is about 99% useless. Or, even worse - rack in ruby. And I did not notice this in the past, in part because e. g. StackOverflow still worked, there were many blogs which helped fill up missing information too. Well all of that is largely gone now or has been slurped up by AI spam. > the era of small, low-value libraries like blob-util is…

Just for context, the person you're responding to works at a place that is a recipient of large donations from anthropic, so they might be less than objective. https://discuss.python.org/t/anthropic-has-made-a-large-contribution-t… edit: My mistake, seems they work at OpenAI. https://blog.pypi.org/posts/2025-08-14-project-status-markers/

PyPI does exactly that, and it's been very effective. Security partners can scan packages and use the invite-only API to report them: https://blog.pypi.org/posts/2024-03-06-malware-reporting-evolved/#via-…

Also related to ZIP parsing differentials, recently reported and fixed at PyPi: https://blog.pypi.org/posts/2025-08-07-wheel-archive-confusion-attacks…

It should be a capital I, not lowercase l in the organization name. They have it right consistently within the article, but not in its title or slug. They're also reposting it from "the hacker news" which to me looks much more interested in SEO than reputation (although they did get the spelling right). I think PyPI's own announcement is a better source for this: https://blog.pypi.org/posts/2025-08-18-preventing-domain-resurrections… It was also shared on the official forums: https://discuss.python.org/t/announcement-pypi-prevents-domain-resurre…

Python users (pypi.org) just got hit that were using TOTP. "If the user had enrolled a Security Device for PyPI second factor authentication, the attacker would not have been able to use the second factor, as the WebAuthn protocol requires the user to physically interact with a hardware security key, or use a browser-based implementation, which would not be possible if the user was not on the legitimate PyPI.org website (Relying Party Identifier)." https://blog.pypi.org/posts/2025-07-31-incident-report-phishing-attack…

it was in the context of blocking email providers because of malicious mass signups (https://blog.pypi.org/posts/2024-06-16-prohibiting-msn-emails/)

To me it's weird that Anthropic is doing this reputation boosting game with Andon Labs which I'd never heard of. It's like when PyPI published a blog post about their security audit with a company which I'd never heard of before and haven't heard of since, that was connected to someone at PyPI. https://blog.pypi.org/posts/2023-11-14-1-pypi-completes-first-security… I wonder if it's a similar cozy relationship here.

They already went through requirering 2FA for the most popular packages: https://blog.pypi.org/posts/2023-05-25-securing-pypi-with-2fa/ This is just another step in increasing security. And of cause that is something you want to preferably do prior to breaches not only as a reaction.

Meanwhile the Python Package Index has recently dropped official support for PGP signatures: https://blog.pypi.org/posts/2023-05-23-removing-pgp/ -- apparently due to too few useful/verifiable signatures, as per https://blog.yossarian.net/2023/05/21/PGP-signatures-on-PyPI-worse-tha…

The volume of malicious users and malicious projects being created on the index in the past week has outpaced our ability to respond to it in a timely fashion Anything to do with the imminent mandatory 2FA? https://blog.pypi.org/posts/2023-05-25-securing-pypi-with-2fa/

New signatures cannot be uploaded to pypi https://blog.pypi.org/posts/2023-05-23-removing-pgp/

> An example of this is that PyPI just got the ability to namespace packages. You're thinking of organizations, which are not namespaces: https://blog.pypi.org/posts/2023-04-23-introducing-pypi-organizations/

Because no other language has ever had supply chain attacks ever, in history. Nope. https://blog.rust-lang.org/2022/05/10/malicious-crate-rustdecimal/ https://en.wikipedia.org/wiki/Log4Shell https://blog.pypi.org/posts/2024-12-11-ultralytics-attack-analysis/ https://about.gitlab.com/blog/gitlab-catches-mongodb-go-module-supply-… https://www.reversinglabs.com/blog/packagist-php-repo-supply-chain-thr…