Python Package Index

@pypi

The Python Package Index (PyPI) is the repository of software for the Python programming language. Pronounced 🥧 🫛 👁️

The Cloud blog.pypi.org Joined September 2017

10 Following 23K Followers 386 Posts

Latest posts 5

🔐 PyPI’s redesigned project pages are live. A new Security tab shows where release files come from, with provenance states, attestations, and warnings. Plus, a rebuilt release files tab. #security #PyPI

Learn more on the PyPI blog:
blog.pypi.org/posts/2026-11-…

blog.pypi.org PyPI's redesigned project pages with clearer security signals are now live - The Python Package... PyPI now makes it simple to check where release files come from, with a dedicated security tab, a rebuilt release files tab, and refreshed documentation.

Python Package Index @pypi Oct 16

#PyPI has moved account registration defenses from reactive to proactive. A new email reputation check catches disposable addresses at signup, no manual blocklist updates by staff or volunteers needed. Another step toward a safer ecosystem 🔐 blog.pypi.org/posts/2026-10-… #Python

blog.pypi.org Checking email reputation, and allowing Outlook again - The Python Package Index Blog PyPI now checks the reputation of new email addresses during registration, and accepts outlook.com and hotmail.com addresses again.

Python Package Index @pypi Oct 15

16.5B requests/day. 13.5 PB served/day. The registry never sleeps. 😴🚫

Made possible by @fastly, who’s donated bandwidth for a decade–thank you!

PyPI is run by @ThePSF, and infrastructure isn’t free. If your team relies on #PyPI, consider sponsoring: pypi.org/sponsors

“The registry never sleeps.” PyPI handles 16.5B requests per day, more than Google’s ~13.7B searches, and transfers 13.5 PB per day. Fastly has donated the bandwidth for a decade. PyPI is run by the Python Software Foundation.

Python Package Index @pypi Jul 22

The #Python Package Index now rejects new files published to releases older than 14 days. This mitigation prevents long-stable releases from being poisoned in case publishing tokens or workflows of #PyPI projects are compromised.

blog.pypi.org/posts/2026-07-…

#security #supplychain

blog.pypi.org Releases now reject new files after 14 days - The Python Package Index Blog PyPI no longer allows publishing new files to releases older than 14 days.

Python Package Index @pypi Apr 16

🔎🔐 #PyPI has completed its second external #security audit! Thanks to Sovereign Tech Agency for funding, @trailofbits for the audit, and @AlphaOmegaOSS for supporting rapid remediation. Find the full report on the Trail of Bits publication page. #Python
blog.pypi.org/posts/2026-04-…

blog.pypi.org PyPI has completed its second audit - The Python Package Index Blog We are proud to announce PyPI's second external security audit.