Python Package Index

https://fosstodon.org/@pypi

The Python Package Index (PyPI) is the repository of software for the Python programming language. Pronounced 🥧 🫛 👁️

Blog: https://blog.pypi.org

Public Key

npub1g52zm7t45x9srp48swy44hc03k2qzkckd63vyqfl0jvnvkzz8n0ql68fy6

NIP-05 Address

pypi_at_fosstodon.org@momostr.pink

Profile Code

nprofile1qqsy29pdl966rzcps6nc8z26mu8cm9qptvtxagkzqylhexfktpprehsprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntqyv8wumn8ghj7un9d3shjtnndehhyapwwdhkx6tpdsxg08uf

Publishing to

relay.momostr.pink

relay.snort.social

atlas.nostr.land

Author Public Key

npub1g52zm7t45x9srp48swy44hc03k2qzkckd63vyqfl0jvnvkzz8n0ql68fy6

Show more details

Last Notes

2026-04-16 13:26:36 UTC

🔎🔐 #PyPI has completed its second external #security audit! Thanks to @npub1yng…nhrk for funding, @npub1rcs…7sw8 for the audit, and Alpha-Omega for supporting rapid remediation. Find the full report on the Trail of Bits publication page. #Python
https://blog.pypi.org/posts/2026-04-16-pypi-completes-second-audit/

2025-09-26 12:45:39 UTC

A campaign targeted GitHub Actions to steal PyPI tokens—PyPI wasn’t compromised and no PyPI packages were published by the attackers. Stay safe: review your tokens, rotate any exposed ones, and use short-lived, scoped GitHub Actions tokens. Details:
https://blog.pypi.org/posts/2025-09-16-github-actions-token-exfiltration/

2025-08-18 17:32:48 UTC

PyPI now checks for expired domains to prevent domain resurrection attacks, a type of supply-chain attack where someone buys an expired domain and uses it to take over #PyPI accounts through password resets. #Python #OpenSource #SupplyChain #Security
https://blog.pypi.org/posts/2025-08-18-preventing-domain-resurrections/