New Login Verification for TOTP-based Logins
We’ve implemented a new security feature designed to protect PyPI users from phishing attacks: email verification for TOTP-based logins from new devices. What’s Changing? Previously, when logging in with a Time-based One-Time Password (TOTP) authenticator, a successful TOTP code was sufficient. Now, if you log in from a device orContinue Reading
Trusted Publishing is popular, now for GitLab Self-Managed and Organizations
Trusted Publishing has proven popular since its launch in 2023. Recap: Trusted Publishing enables software build platforms to publish packages to PyPI on your behalf, eliminating the need to manage long-lived authentication tokens. After a one-time setup where you delegate publishing authority to your platform, it automatically obtains short-lived, scopedContinue Reading
New Expense Submission flow 🎉
We are pleased to announce the release of the new Expense Submission flow! 🎉 We’ve done a lot to increase the odds that your expenses are submitted correctly, pass the essential checks from Collectives and Fiscal Hosts, and are paid promptly. Hundreds of users have been trialing the new flow,Continue Reading
Signature Verification: How to Verify a Digital Signature Online
Digital signatures add another layer of security to your online transactions and communications. But how can you know they’re real? We’ll walk you through how to verify a digital signature online in several popular systems and email clients Digital signatures, unlike electronic signatures, can be cryptographically proven. This enables recipientsContinue Reading
Phishing attacks with new domains likely to continue
Unfortunately the string of phishing attacks using domain-confusionand legitimate-looking emails continues. This is the same attack PyPI saw a few months agoand targeting many other open source repositoriesbut with a different domain name. Judging from this, we believe this type of campaign will continuewith new domains in the future. InContinue Reading
Token Exfiltration Campaign via GitHub Actions Workflows
Summary I recently responded to an attack campaign where malicious actors injected code into GitHub Actions workflows attempting to steal PyPI publishing tokens.PyPI was not compromised, and no PyPI packages were published by the attackers. Attackers targeted a wide variety of repositories, many of which had PyPI tokens stored asContinue Reading
An Explainer Guide on Multi-Perspective Issuance Corroboration (MPIC)
Internet security is leveling up with MPIC. While your organization likely won’t need to do anything to prepare, here’s what to know about the industry’s changes and why they’re good for security Starting Sept 15, 2025, all publicly trusted certification authorities (CAs such as DigiCert, Sectigo, etc.) must perform domainContinue Reading
‘World Quantum Readiness Day’ Returns with the Latest in PQC
Sept. 10: Get actionable insights from 20+ global experts as they discuss PQC readiness assessments, migration plans, and other practical strategies DigiCert is hosting its second annual World Quantum Readiness Day on Wednesday, Sept. 10, 2025. This two-hour webinar, themed “Quantum Blueprint: From Business Justification to Technical Readiness,” will featureContinue Reading
Preventing Domain Resurrection Attacks
Summary PyPI now checks for expired domains to prevent domain resurrection attacks,a type of supply-chain attack where someone buys an expired domainand uses it to take over PyPI accounts through password resets. These changes improve PyPI’s overall account security posture,making it harder for attackers to exploit expired domain namesto gainContinue Reading
PyPI now serves project status markers in API responses
PyPI now serves project status markers in its standardindex APIs. This allows downstream consumers (like Python package installers andindex mirrors) to retrieve project statuses programmatically and use them toinform users when a project is archived or quarantined. Summary PyPI has implemented project status markers as proposed and accepted in PEPContinue Reading