The Python Package Index (PyPI) is the repository of software for the Python programming language. Pronounced 🥧 🫛 👁️
The Cloud
Joined September 2017
- Tweets384
- Following10
- Followers23.4K
- Likes82
#PyPI has moved account registration defenses from reactive to proactive. A new email reputation check catches disposable addresses at signup, no manual blocklist updates by staff or volunteers needed. Another step toward a safer ecosystem 🔐 blog.pypi.org/posts/2026-10-… #Python
16.5B requests/day. 13.5 PB served/day. The registry never sleeps. 😴🚫
Made possible by @fastly, who’s donated bandwidth for a decade–thank you!
PyPI is run by @ThePSF, and infrastructure isn’t free. If your team relies on #PyPI, consider sponsoring: pypi.org/sponsors
ALT “The registry never sleeps.” PyPI handles 16.5B requests per day, more than Google’s ~13.7B searches, and transfers 13.5 PB per day. Fastly has donated the bandwidth for a decade. PyPI is run by the Python Software Foundation.
Python Package Index retweeted
#PyPI runs on ~zero AWS cost thanks to @FastlyDevs caching 99% of traffic + @AWSOpen credits covering the rest. Huge thanks to both! But 2026 broke an 8-year streak: AWS spend is up 69% YoY as agents & CI runs surge.
Jacob Coffee, PSF Director of Engineering, on what's changing: pyfound.blogspot.com/2026/08…
#Python
The #Python Package Index now rejects new files published to releases older than 14 days. This mitigation prevents long-stable releases from being poisoned in case publishing tokens or workflows of #PyPI projects are compromised.
blog.pypi.org/posts/2026-07-…
#security #supplychain
Python Package Index retweeted
Watch PSF PyPI Safety & Security Engineer Mike Fiedler's talk from Open Source Summit NA 2026: Trusted Publishing uses OIDC to generate short-lived tokens from CI/CD. No passwords. No tokens to rotate. No secrets in repos.
youtube.com/watch?v=i0BWrWdZ…
#Python #PyPI #OSSummit #Security
Python Package Index retweeted
Hear from PSF's @pypi Support Specialist Maria Ashna on what her day-to-day looks like, how she cleared multiple months-long backlogs, and the future of PyPI Orgs in this Behind the Commit episode from Mia Bajić.
▶️ youtube.com/watch?v=OGIznDrF…
#Python #PyPI #OpenSource
Python Package Index retweeted
The PSF is looking for a PyPI Sustainability Engineer to join the team! This is a full time, 1-year contract (with the possibility of renewal), globally remote position. If you love #Python, care about open source, and want your work to matter at infrastructure scale–consider applying! Please boost this post and share with your colleagues and networks. #PyPI #Python
pythonsoftwarefoundation.app…
pythonsoftwarefoundation.app…
🔎🔐 #PyPI has completed its second external #security audit! Thanks to Sovereign Tech Agency for funding, @trailofbits for the audit, and @AlphaOmegaOSS for supporting rapid remediation. Find the full report on the Trail of Bits publication page. #Python
blog.pypi.org/posts/2026-04-…
PSF Security developers have published incident reports on the LiteLLM & Telnyx #supplychain attacks. Read what happened, who's affected, and what developers & maintainers can do to prepare and protect themselves from future incidents. #security #python
blog.pypi.org/posts/2026-04-…
Over the past year (and a half!), our inaugural PyPI Support Specialist, Maria Ashna, helped tackle backlogs, improve support processes, and keep #PyPI running smoothly for the #Python community.
Read the full reflection on what that work looked like 👇
blog.pypi.org/posts/2026-01-…
2025 was another eventful year for PyPI! Critical security enhancements, powerful new org features, a better overall user experience, and transparent security incident response 🎉👏 Thank you, PyPI team & community!
Learn more on our blog: blog.pypi.org/posts/2025-12-…
ALT Infographic of PyPI statistics, with a yellow background, blue and grey text, and blue rectangles to highlight each statistic. Title states "PyPI in 2025". Underneath are 5 statistics: 3.9 million+ new files published 130,000+ new projects created 1.92 exabytes of total data transferred 2.56 trillion total requests served 81,000 requests per second on average At the bottom is the PyPI logo, "Python package index" with blocks in the shape of the Python logo.
🚨 New PyPI blog post
TL,DR:
- Trusted Publishing used for 25% of all files uploaded in Oct 2025
- @gitlab Self-Managed now in beta
- Pending Publishers can be added for Organizations, too!
#Python #SupplyChain #Security
blog.pypi.org/posts/2025-11-…
Python Package Index retweeted
PyPI serves billions of requests daily- but sustaining it isn’t free. The PSF joined the OpenSSF & others in calling for organizations to invest in sustainable open infrastructure. Learn what this means for #PyPI, the PSF, & how our community can pitch in:
pyfound.blogspot.com/2025/10…
A campaign targeted GitHub Actions to steal PyPI tokens—PyPI wasn’t compromised and no PyPI packages were published by the attackers. Stay safe: review your tokens, rotate any exposed ones, and use short-lived, scoped GitHub Actions tokens. Details:
blog.pypi.org/posts/2025-09-…
🚨 There is a new ongoing phishing campaign against PyPI users. This campaign uses the same tactics as the previous campaign targeting PyPI users, but with a new domain.
Read more about what steps we're taking to protect PyPI users from future campaigns:
blog.pypi.org/posts/2025-09-…
Python Package Index retweeted
The PSF has adopted pypistats.org, ensuring long-term stability while staying open source and community driven 🎉 Thank you to Christopher Flynn, for operating this community service for 6+ years- and for continuing to maintain the project 💪🐍 pyfound.blogspot.com/2025/08…
PyPI now checks for expired domains to prevent domain resurrection attacks, a type of supply-chain attack where someone buys an expired domain and uses it to take over #PyPI accounts through password resets. #Python #OpenSource #SupplyChain #Security
blog.pypi.org/posts/2025-08-…
The Python Package Index is introducing new restrictions to protect Python package installers and inspectors from ZIP confusion attacks. There is no evidence that this vulnerability has been exploited. Read the blog post for more information:
blog.pypi.org/posts/2025-08-…
We're happy to share that we've started a #PyPI Bluesky account 🦋🐍 and we welcome you to follow us if you're over there! We will still continue to share announcements here. bsky.app/profile/pypi.org #python
bsky.app/profile/pypi.org