Science & Tech · Cybersecurity · 4 hrs ago
PyPI adds a security tab to show package release origins
The Python Package Index added a Security tab to project pages so developers can check where release files came from.
Digital attestations can show who uploaded a file and link it to its source code, build system and instructions.
A release has full provenance when every file has at least one attestation; without attestations, its origin cannot be cryptographically verified.
Missing attestations do not mean a package is malicious, and they are common in older releases and projects that have not set up Trusted Publishing.
PyPI warns users when only some files are attested or when a release comes from a different repository or workflow than before.
Those changes may be legitimate but can also signal a compromised account or build process, so users can review the details and transparency logs.
The Release Files and Release History tabs also let users check file-level status and compare versions; since PyPI’s July 2026 policy change, it rejects late uploads.
PyPI has added a Security tab to project pages so developers can check the origins of individual release files.
The tab shows whether files have digital attestations that provide verifiable information about how they were published or built.
PyPI warns when a release has only partial attestations or when its files come from different repositories or build systems.
A missing attestation does not necessarily mean a release is malicious, but it means its origin cannot be cryptographically verified.
The redesigned pages also show provenance status in release files and release history.
- Who
- The Python Package Index (PyPI) introduced the Security tab for developers and package users.
- What
- PyPI added a tab showing release-file attestations and provenance details, including warnings about incomplete or changed origins.
- When
- The article was published on 2026-11-09. PyPI’s policy change on late uploads took effect in July 2026.
- Where
- On PyPI project pages.
- Why
- To make it easier to check where release files came from and review their verifiable publication or build information.
This story does not have two clearly opposing sides.
PyPI began refusing late uploads to releases.
Help Net Security reported that PyPI had added a Security tab to project pages.
- Platform
- Python Package Index (PyPI)
- New feature
- Security tab on project pages
- Attestation types
- PyPI Publish and SLSA Build Provenance
- Late-upload policy
- Since July 2026, PyPI has refused late uploads
- Policy threshold for older releases
- Files uploaded more than 14 days after the initial release are flagged
What people are saying
a release isn’t necessarily malicious