STORY · REGULERING_
PyPI blocks uploads to old releases to prevent supply chain attacks
Python Package Index (PyPI) has implemented a security restriction that refuses to accept new files for releases older than 14 days. The measure is designed to prevent hackers who gain access to compromised publishing keys or workflows from poisoning established packages by adding malicious code to old versions.
WHY IT MATTERS
This addresses a critical vulnerability in the Python ecosystem: if an attacker hacked into a project's publishing credentials, they could previously inject malicious code into old, stable releases that many developers still use. This change eliminates that attack vector.
SOURCES
MACHINE-GENERATED SUMMARY This summary is written by machine from the sources below. We sort and explain — but we are a way into the field, not the final word. Check the source when something matters to you.