Quoting Seth Larson
Simon Willison · Simon Willison · 2026-07-23
PyPI now rejects new file uploads to releases older than 14 days, a proactive security measure to prevent supply chain attacks via compromised publishing tokens or workflows.
Extraction
Topics: python-packagingsupply-chain-securitypypipackage-registry-security
Claims
- PyPI rejects new file uploads to any release older than 14 days.
- The policy was introduced to prevent attackers from poisoning old, stable releases via compromised publishing tokens or CI/CD workflows.
- No known exploitation of this attack vector has been observed yet.
- The only reason this vector was not previously abused was attacker unawareness, not any technical barrier.
Key quotes
PyPI now rejects new files being uploaded to releases that are older than 14 days. This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised.
As far as we are aware this has not yet been abused, but there is no technical reason beyond that attackers weren't aware it was possible.