{"slug": "pypi", "name": "PyPI", "category": "dev-libs", "category_name": "Libraries and frameworks", "description": "", "recommenders": 4, "commenters": 21, "warners": 11, "score": -5.035, "rising": 1.02, "first": "2025-11-29", "latest": "2026-10-31", "why": "PyPI does exactly that, and it's been very effective.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 5, "neutral": 6, "compare": 0, "warn": 12}, "spark": [1, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 2], "listed": true, "loved": [], "caveat": "", "short_quote": "PyPI does exactly that, and it's been very effective.", "kind": "", "icon": false, "domain": null, "github_repo": null, "official_url": "https://pypi.org", "pricing": "", "aliases": ["PyPI"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 803503632, "item_id": 50218977, "url": "https://news.ycombinator.com/item?id=50218977", "by": "bbor", "date": "2026-10-24", "version": null, "stance": "recommend", "quote": "Well first off I love PyPI", "excerpt": "Well first off I love PyPI and am greatly offended on the behalf of thew newly-formed (forming?) council to fix it, but also I don't think that applies in this case. If your server is capable of decoding brotli packets it's at risk -- you don't have to actually use that functionality regularly.", "context": "", "use_case": "Python packages", "switched_from": "", "story": "Evolving Threat: http2shell is an RCE in Node, Python, and more"}, {"id": 802029104, "item_id": 50126819, "url": "https://news.ycombinator.com/item?id=50126819", "by": "zahlman", "date": "2026-10-17", "version": null, "stance": "recommend", "quote": "it protects several of the most popular packages", "excerpt": "> But there is a problem - you can upload binaries that don't match the source. Yes, this is well understood by the relevant people working on packaging. Unfortunately, reproducible builds are hard enough when you have a single, compiled language to work with; the Python ecosystem really can't support it. The main approach for ensuring source to binary correspondence now is \"Trusted Publishing\": https://docs.pypi.org", "context": "", "use_case": "", "switched_from": "", "story": "Python's binary wheels and supply chain attacks"}, {"id": 784768784, "item_id": 49048049, "url": "https://news.ycombinator.com/item?id=49048049", "by": "woodruffw", "date": "2026-07-25", "version": null, "stance": "recommend", "quote": "This closes a gap in the legacy upload API", "excerpt": "Yes, that would be a better setup and it\u2019s exactly what PyPI is moving to[1]. This closes a gap in the legacy upload API, which evolved over time instead of being designed to avoid these kinds of problems. [1]: https://peps.python.org/pep-0694/", "context": "", "use_case": "", "switched_from": "", "story": "PyPI Blog: Releases now reject new files after 14 days"}, {"id": 771121456, "item_id": 48195091, "url": "https://news.ycombinator.com/item?id=48195091", "by": "zahlman", "date": "2026-05-19", "version": null, "stance": "recommend", "quote": "PyPI also tries a fair bit to monitor for incoming malware", "excerpt": "In fact, attacks like Shai-Hulud explicitly attempt to get into PyPI, and have succeeded to a lesser extent. But aside from the package-size / -complexity issue pointed out in a sibling comment, PyPI also tries a fair bit to monitor for incoming malware (and there's a \"report project as malware\" button on each project page). Also, there are no post-install scripts (of course, the code can detect when it's being run f", "context": "", "use_case": "", "switched_from": "", "story": "Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised"}, {"id": 760520544, "item_id": 47532534, "url": "https://news.ycombinator.com/item?id=47532534", "by": "simonw", "date": "2026-03-26", "version": null, "stance": "recommend", "quote": "PyPI does exactly that, and it's been very effective.", "excerpt": "PyPI does exactly that, and it's been very effective. Security partners can scan packages and use the invite-only API to report them: https://blog.pypi.org/posts/2024-03-06-malware-reporting-evolved/#via-api", "context": "", "use_case": "", "switched_from": "", "story": "My minute-by-minute response to the LiteLLM malware attack"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 805114545, "item_id": 50319659, "url": "https://news.ycombinator.com/item?id=50319659", "by": "0xbadcafebee", "date": "2026-10-31", "version": null, "stance": "warn", "quote": "insanely easy to attack \"programming language package ecosystems\", like NPM, PyPI", "excerpt": "All the extra code isn't really the problem, it's the insanely easy to attack \"programming language package ecosystems\", like NPM, PyPI, etc, compared to something like the Linux package ecosystem. But this is a much less common problem than malware and phishing. Supply chain is more of a concern than it used to be, but thousands of people get infected with malware or phished every day, versus relatively few supply c", "context": "", "use_case": "", "switched_from": "", "story": "Malware uses LLMs to rank victims by how much they're worth"}, {"id": 800563715, "item_id": 50035232, "url": "https://news.ycombinator.com/item?id=50035232", "by": "zargon", "date": "2026-10-10", "version": null, "stance": "warn", "quote": "I never trust npm, pypi, etc. any longer.", "excerpt": "These days, most things that I run that aren't from my distro's repos get their own bubblewrap. On top of this, I use opensnitch. Even if I trust the application (uncommon), I never trust npm, pypi, etc. any longer. It's tedious to set this up and OSes should be helping make this easy.", "context": "", "use_case": "", "switched_from": "", "story": "Telegram Desktop vulnerability allowed any user's file to be stolen"}, {"id": 776392499, "item_id": 48524531, "url": "https://news.ycombinator.com/item?id=48524531", "by": "cookiengineer", "date": "2026-06-13", "version": null, "stance": "warn", "quote": "PyPi is also affected", "excerpt": "> Someone or something should vuln-scan these packages as they're published, as a number of companies do for NPM now. That would likely have found these pretty quickly. No. It wouldn't have. That's the point of the miasma worm, because it changes too fast in its signatures and helper methods. The encrypted malware implant uses a changing AES-128-GCM key that's used to decrypt the payload, and that key is per-where-it", "context": "", "use_case": "Package registry", "switched_from": "", "story": "Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages"}, {"id": 770509058, "item_id": 48156816, "url": "https://news.ycombinator.com/item?id=48156816", "by": "swang", "date": "2026-05-15", "version": null, "stance": "warn", "quote": "literally the latest attack included publishing malicious packages on PyPi", "excerpt": "Ah yes, only `npm` has ever suffered an attack. Ever. RubyGems: https://www.sonatype.com/blog/anatomy-of-the-rubygems-rest-client-hack-and-getting-creative-about-open-source-security PyPi: literally the latest attack included publishing malicious packages on PyPi XZ Tools, a part of nearly every Linux distribution nearly merged in code to backdoor SSH: https://www.akamai.com/blog/security-research/critical-linux-back", "context": "", "use_case": "", "switched_from": "", "story": "'No Way to Prevent This,' Says Only Package Manager Where This Regularly Happens"}]}], "who": [], "tags": [], "use_cases": ["python packages", "package registry", "python package registry", "package publishing"], "compared": [{"slug": "npm", "name": "npm", "co": 6, "switched_from": 0, "switched_to": 0}, {"slug": "uv", "name": "uv", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "github", "name": "GitHub", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "rubygems", "name": "RubyGems", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "pip", "name": "pip", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [{"id": 744684128, "item_id": 46542758, "url": "https://news.ycombinator.com/item?id=46542758", "by": "woodruffw", "date": "2026-01-08", "version": null, "stance": "neutral", "quote": "Both Trusted Publishing and attestations were multi-year projects", "excerpt": "> So there's already a key involved. I realize its lifetime might not be suitable but presumably the pipeline itself either already possesses or could generate a long lived key to be registered with the central service. The key involved is the OIDC IdP's key, which isn't controlled by the maintainer of the project. I think it would be pretty risky to allow this key to directly sign for packages, because this would im", "context": "", "use_case": "Python package index", "switched_from": "", "story": "NPM to implement staged publishing after turbulent shift off classic tokens"}, {"id": 744495200, "item_id": 46530950, "url": "https://news.ycombinator.com/item?id=46530950", "by": "woodruffw", "date": "2026-01-07", "version": null, "stance": "recommend", "quote": "when we designed Trusted Publishing for PyPI, we designed it to be generic across OIDC IdPs", "excerpt": "> In its current form, however, trusted publishing applies to a limited set of use cases. Support is restricted to a small number of CI providers, it cannot be used for the first publish of a new package, and it does not yet offer enforcement mechanisms such as mandatory 2FA at publish time. Those constraints have led maintainer groups to caution against treating trusted publishing as a universal upgrade, particularl", "context": "", "use_case": "", "switched_from": "", "story": "NPM to implement staged publishing after turbulent shift off classic tokens"}], "threads": [{"url": "https://news.ycombinator.com/item?id=46530448", "title": "NPM to implement staged publishing after turbulent shift off classic tokens", "mentions": 5}, {"url": "https://news.ycombinator.com/item?id=47531967", "title": "My minute-by-minute response to the LiteLLM malware attack", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=46447202", "title": "PyPI in 2025: A Year in Review", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=46391514", "title": "Package managers keep using Git as a database, it never works out", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=50316531", "title": "Malware uses LLMs to rank victims by how much they're worth", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=50216791", "title": "Evolving Threat: http2shell is an RCE in Node, Python, and more", "mentions": 1}], "sentiment_by_month": {"2025-11": {"recommend": 1}, "2025-12": {"warn": 1, "neutral": 1}, "2026-01": {"warn": 5, "neutral": 1}, "2026-02": {"neutral": 1}, "2026-03": {"neutral": 2, "warn": 2, "recommend": 1}, "2026-04": {}, "2026-05": {"warn": 1, "neutral": 1, "recommend": 1}, "2026-06": {"warn": 1}, "2026-07": {}, "2026-08": {}, "2026-09": {}, "2026-10": {"warn": 2, "recommend": 2}}, "versions": [], "version_unnamed": 0, "quotes": [{"id": 805114545, "item_id": 50319659, "url": "https://news.ycombinator.com/item?id=50319659", "by": "0xbadcafebee", "date": "2026-10-31", "version": null, "stance": "warn", "quote": "insanely easy to attack \"programming language package ecosystems\", like NPM, PyPI", "excerpt": "All the extra code isn't really the problem, it's the insanely easy to attack \"programming language package ecosystems\", like NPM, PyPI, etc, compared to something like the Linux package ecosystem. But this is a much less common problem than malware and phishing. Supply chain is more of a concern than it used to be, but thousands of people get infected with malware or phished every day, versus relatively few supply c", "context": "", "use_case": "", "switched_from": "", "story": "Malware uses LLMs to rank victims by how much they're worth"}, {"id": 803503632, "item_id": 50218977, "url": "https://news.ycombinator.com/item?id=50218977", "by": "bbor", "date": "2026-10-24", "version": null, "stance": "recommend", "quote": "Well first off I love PyPI", "excerpt": "Well first off I love PyPI and am greatly offended on the behalf of thew newly-formed (forming?) council to fix it, but also I don't think that applies in this case. If your server is capable of decoding brotli packets it's at risk -- you don't have to actually use that functionality regularly.", "context": "", "use_case": "Python packages", "switched_from": "", "story": "Evolving Threat: http2shell is an RCE in Node, Python, and more"}, {"id": 802029104, "item_id": 50126819, "url": "https://news.ycombinator.com/item?id=50126819", "by": "zahlman", "date": "2026-10-17", "version": null, "stance": "recommend", "quote": "it protects several of the most popular packages", "excerpt": "> But there is a problem - you can upload binaries that don't match the source. Yes, this is well understood by the relevant people working on packaging. Unfortunately, reproducible builds are hard enough when you have a single, compiled language to work with; the Python ecosystem really can't support it. The main approach for ensuring source to binary correspondence now is \"Trusted Publishing\": https://docs.pypi.org", "context": "", "use_case": "", "switched_from": "", "story": "Python's binary wheels and supply chain attacks"}, {"id": 800563715, "item_id": 50035232, "url": "https://news.ycombinator.com/item?id=50035232", "by": "zargon", "date": "2026-10-10", "version": null, "stance": "warn", "quote": "I never trust npm, pypi, etc. any longer.", "excerpt": "These days, most things that I run that aren't from my distro's repos get their own bubblewrap. On top of this, I use opensnitch. Even if I trust the application (uncommon), I never trust npm, pypi, etc. any longer. It's tedious to set this up and OSes should be helping make this easy.", "context": "", "use_case": "", "switched_from": "", "story": "Telegram Desktop vulnerability allowed any user's file to be stolen"}, {"id": 784768784, "item_id": 49048049, "url": "https://news.ycombinator.com/item?id=49048049", "by": "woodruffw", "date": "2026-07-25", "version": null, "stance": "recommend", "quote": "This closes a gap in the legacy upload API", "excerpt": "Yes, that would be a better setup and it\u2019s exactly what PyPI is moving to[1]. This closes a gap in the legacy upload API, which evolved over time instead of being designed to avoid these kinds of problems. [1]: https://peps.python.org/pep-0694/", "context": "", "use_case": "", "switched_from": "", "story": "PyPI Blog: Releases now reject new files after 14 days"}, {"id": 776392499, "item_id": 48524531, "url": "https://news.ycombinator.com/item?id=48524531", "by": "cookiengineer", "date": "2026-06-13", "version": null, "stance": "warn", "quote": "PyPi is also affected", "excerpt": "> Someone or something should vuln-scan these packages as they're published, as a number of companies do for NPM now. That would likely have found these pretty quickly. No. It wouldn't have. That's the point of the miasma worm, because it changes too fast in its signatures and helper methods. The encrypted malware implant uses a changing AES-128-GCM key that's used to decrypt the payload, and that key is per-where-it", "context": "", "use_case": "Package registry", "switched_from": "", "story": "Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages"}, {"id": 771121456, "item_id": 48195091, "url": "https://news.ycombinator.com/item?id=48195091", "by": "zahlman", "date": "2026-05-19", "version": null, "stance": "recommend", "quote": "PyPI also tries a fair bit to monitor for incoming malware", "excerpt": "In fact, attacks like Shai-Hulud explicitly attempt to get into PyPI, and have succeeded to a lesser extent. But aside from the package-size / -complexity issue pointed out in a sibling comment, PyPI also tries a fair bit to monitor for incoming malware (and there's a \"report project as malware\" button on each project page). Also, there are no post-install scripts (of course, the code can detect when it's being run f", "context": "", "use_case": "", "switched_from": "", "story": "Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised"}, {"id": 770718560, "item_id": 48169910, "url": "https://news.ycombinator.com/item?id=48169910", "by": "0123456789ABCDE", "date": "2026-05-17", "version": null, "stance": "neutral", "quote": "i've used pypi, which enables: `uvx <package name>` or `uv tool install <package name>` for a more permanent setup", "excerpt": "i've used pypi, which enables: `uvx <package name>` or `uv tool install <package name>` for a more permanent setup some folks go to the trouble of publishing with `brew` then there's the old `curl -LsSf https://example.com/install.sh | sh`", "context": "", "use_case": "", "switched_from": "", "story": "MCP Hello Page"}, {"id": 770509058, "item_id": 48156816, "url": "https://news.ycombinator.com/item?id=48156816", "by": "swang", "date": "2026-05-15", "version": null, "stance": "warn", "quote": "literally the latest attack included publishing malicious packages on PyPi", "excerpt": "Ah yes, only `npm` has ever suffered an attack. Ever. RubyGems: https://www.sonatype.com/blog/anatomy-of-the-rubygems-rest-client-hack-and-getting-creative-about-open-source-security PyPi: literally the latest attack included publishing malicious packages on PyPi XZ Tools, a part of nearly every Linux distribution nearly merged in code to backdoor SSH: https://www.akamai.com/blog/security-research/critical-linux-back", "context": "", "use_case": "", "switched_from": "", "story": "'No Way to Prevent This,' Says Only Package Manager Where This Regularly Happens"}, {"id": 761230544, "item_id": 47576909, "url": "https://news.ycombinator.com/item?id=47576909", "by": "zahlman", "date": "2026-03-30", "version": null, "stance": "warn", "quote": "", "excerpt": "You may be interested in this discussion: https://discuss.python.org/t/use-of-pypi-as-a-generic-storage-platform-for-binaries/106044", "context": "", "use_case": "", "switched_from": "", "story": "ninja: a small build system with a focus on speed"}, {"id": 760539312, "item_id": 47533707, "url": "https://news.ycombinator.com/item?id=47533707", "by": "simonw", "date": "2026-03-26", "version": null, "stance": "neutral", "quote": "PyPI has paid organization accounts now which are beginning to form a meaningful revenue stream", "excerpt": "Very much not speaking for the PSF here, but my personal opinion on why that wouldn't work is that Python is a global language and collecting fees on a global basis is inherently difficult - and we don't want to discriminate against people in countries where the payment infrastructure is hard to support. PyPI has paid organization accounts now which are beginning to form a meaningful revenue stream: https://docs.pypi", "context": "", "use_case": "", "switched_from": "", "story": "My minute-by-minute response to the LiteLLM malware attack"}, {"id": 760520544, "item_id": 47532534, "url": "https://news.ycombinator.com/item?id=47532534", "by": "simonw", "date": "2026-03-26", "version": null, "stance": "recommend", "quote": "PyPI does exactly that, and it's been very effective.", "excerpt": "PyPI does exactly that, and it's been very effective. Security partners can scan packages and use the invite-only API to report them: https://blog.pypi.org/posts/2024-03-06-malware-reporting-evolved/#via-api", "context": "", "use_case": "", "switched_from": "", "story": "My minute-by-minute response to the LiteLLM malware attack"}, {"id": 760403776, "item_id": 47525236, "url": "https://news.ycombinator.com/item?id=47525236", "by": "xenophonf", "date": "2026-03-25", "version": null, "stance": "neutral", "quote": "PyPI enforces immutable releases.", "excerpt": "PyPI enforces immutable releases. https://pypi.org/help/#file-name-reuse > PyPI does not allow for a filename to be reused, even once a project has been deleted and recreated... > This ensures that a given distribution for a given release for a given project will always resolve to the same file, and cannot be surreptitiously changed one day by the projects maintainer or a malicious party (it can only be removed).", "context": "", "use_case": "Python package registry", "switched_from": "", "story": "Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised"}, {"id": 759064177, "item_id": 47441511, "url": "https://news.ycombinator.com/item?id=47441511", "by": "wrqvrwvq", "date": "2026-03-19", "version": null, "stance": "warn", "quote": "The other thing i love about npm and pypi", "excerpt": "Don't get me wrong I love getting 300 dependabot updates per day. It's a huge productivity booster and even if you devote 1/2 your dev team to keeping this shit up to date, you'd still be vulnerable to repo-jacking, because the entire pkg ecosystem is broken. The other thing i love about npm and pypi is the way a single small team will re-download in ci (regardless of caching) a TiB of packages all day long for no re", "context": "", "use_case": "", "switched_from": "", "story": "Astral to Join OpenAI"}, {"id": 756710928, "item_id": 47294433, "url": "https://news.ycombinator.com/item?id=47294433", "by": "the_jeremy", "date": "2026-03-07", "version": null, "stance": "neutral", "quote": "PyPI is the Python Package Index, which is up and maintained", "excerpt": "If anyone else is also barely aware and confused by the similar names, PyPI is the Python Package Index, which is up and maintained. PyPy is \"A fast, compliant alternative implementation of Python.\" which doesn't have enough devs to release a version for 3.12[0]. [0]: https://github.com/orgs/pypy/discussions/5145", "context": "", "use_case": "", "switched_from": "", "story": "\"Warn about PyPy being unmaintained\""}, {"id": 751595888, "item_id": 46974743, "url": "https://news.ycombinator.com/item?id=46974743", "by": "elashri", "date": "2026-02-11", "version": null, "stance": "neutral", "quote": "pypi also added this last year", "excerpt": "pypi also added this last year [1] and encouraging people to use trusted publishing as well. [1] https://docs.pypi.org/trusted-publishers/", "context": "", "use_case": "", "switched_from": "", "story": "Chrome extensions spying on 37M users' browsing data"}, {"id": 748397040, "item_id": 46774815, "url": "https://news.ycombinator.com/item?id=46774815", "by": "latexr", "date": "2026-01-26", "version": null, "stance": "warn", "quote": "", "excerpt": "\u2014 Why are you launching nukes? No one asked you to obliterate humanity. \u2014 You\u2019re absolutely right. I should not have done that. Would you like me to help undo the launch? \u2014 Yes! Quickly! Do it! \u2014 <completely made up crap which does not work> https://www.newyorker.com/cartoon/a16995", "context": "", "use_case": "", "switched_from": "", "story": "ChatGPT Containers can now run bash, pip/npm install packages and download files"}, {"id": 745172992, "item_id": 46573312, "url": "https://news.ycombinator.com/item?id=46573312", "by": "woodruffw", "date": "2026-01-10", "version": null, "stance": "recommend", "quote": "just about every complex aspect of PyPI's attestation scheme has a reason behind it", "excerpt": "You linked to a page that has the \"how\" of attestations, not the \"what,\" so it's not super surprising that you don't see an answer there. This page details the \"what\"[1]. > PyPI could check the GitHub immutable tag, read the commit hash, and verify the whole chain of hashes from the files to the tree to the commit. Tags are neither immutable nor durable on GitHub. This also breaks in the presence of any non-trivial b", "context": "", "use_case": "", "switched_from": "", "story": "PyPI in 2025: A Year in Review"}, {"id": 744979152, "item_id": 46561197, "url": "https://news.ycombinator.com/item?id=46561197", "by": "nickysielicki", "date": "2026-01-09", "version": null, "stance": "neutral", "quote": "For better or worse, pypi is the executable distribution mechanism of the future", "excerpt": "For better or worse, pypi is the executable distribution mechanism of the future. Other cool tools you can install from pypi: 1. https://pypi.org/project/cmake/ 2. https://pypi.org/project/ninja/ 3. an entire c/c++/zig toolchain: https://pypi.org/project/ziglang/ 4. the nvcc cuda compiler: https://pypi.org/project/nvidia-cuda-nvcc/", "context": "", "use_case": "", "switched_from": "", "story": "Deno has made its PyPI distribution official"}, {"id": 744641264, "item_id": 46540079, "url": "https://news.ycombinator.com/item?id=46540079", "by": "eesmith", "date": "2026-01-08", "version": null, "stance": "warn", "quote": "That is one of the reasons I stopped using PyPI and instead distribute my wheels from my own web site.", "excerpt": "PyPI is already centralized. Back when I started with PyPI, manual upload through the web interface was the only possibility. Have they gotten rid of that? My understanding is that \"trusted publishing\"[0] was meant as an additional alternative to that sort of manual processing. It was never decentralized. As I recall, the initial version only supported GitHub and (I think) GitLab. [0] I do not trust Microsoft as an i", "context": "", "use_case": "", "switched_from": "", "story": "NPM to implement staged publishing after turbulent shift off classic tokens"}, {"id": 744588336, "item_id": 46536771, "url": "https://news.ycombinator.com/item?id=46536771", "by": "veeti", "date": "2026-01-07", "version": null, "stance": "warn", "quote": "only the big boys are allowed to become", "excerpt": "Yet in practice, only the big boys are allowed to become \"Trusted Publishers\": > In the interest of making the best use of PyPI's finite resources, we only plan to support platforms that have a reasonable level of usage among PyPI users for publishing. Additionally, we have high standards for overall reliability and security in the operation of a supported Identity Provider: in practice, this means that a home-grown ", "context": "", "use_case": "", "switched_from": "", "story": "NPM to implement staged publishing after turbulent shift off classic tokens"}, {"id": 744542688, "item_id": 46533918, "url": "https://news.ycombinator.com/item?id=46533918", "by": "woodruffw", "date": "2026-01-07", "version": null, "stance": "recommend", "quote": "PyPI did a good job of documenting why", "excerpt": "> People now have assigned extra qualities to such releases and it pushes the ecosystem towards more dependency on closed CI systems such as github and gitlab. I think this is unfortunately true, but it's also a tale as old as time. I think PyPI did a good job of documenting why you shouldn't treat attestations as evidence of security modulo independent trust in an identity[1], but the temptation to verify a signatur", "context": "", "use_case": "", "switched_from": "", "story": "NPM to implement staged publishing after turbulent shift off classic tokens"}, {"id": 743968304, "item_id": 46498019, "url": "https://news.ycombinator.com/item?id=46498019", "by": "kpcyrd", "date": "2026-01-05", "version": null, "stance": "warn", "quote": "The situation that PyPi is in is clearly worse", "excerpt": "Sure let me put all that on my credit card because some guy doesn't like git. The situation that PyPi is in is clearly worse: https://stackoverflow.com/questions/39537938/how-do-i-download-the-entire-pypi-python-package-index", "context": "", "use_case": "", "switched_from": "", "story": "Package managers keep using Git as a database, it never works out"}, {"id": 743240528, "item_id": 46452533, "url": "https://news.ycombinator.com/item?id=46452533", "by": "amluto", "date": "2026-01-01", "version": null, "stance": "warn", "quote": "Why do people come up with such unbelievably complex solutions", "excerpt": "> Trusted Publishing Why do people come up with such unbelievably complex solutions that don\u2019t actually achieve what a simple solution could do? Trusted Publishing approximately involves a service like GitHub proving to somebody that some release artifact came from a GitHub Actions workflow file with a particular name, possibly in a particular commit. Never mind that GitHub Actions is an unbelievable security nightma", "context": "", "use_case": "", "switched_from": "", "story": "PyPI in 2025: A Year in Review"}, {"id": 742329904, "item_id": 46395619, "url": "https://news.ycombinator.com/item?id=46395619", "by": "machinationu", "date": "2025-12-26", "version": null, "stance": "neutral", "quote": "there are no rate limits on pypi", "excerpt": "numpy had 16M downloads yesterday, at 10 MB that's 160 TB of traffic. It's one package. And there are no rate limits on pypi. https://clickpy.clickhouse.com/dashboard/numpy", "context": "", "use_case": "", "switched_from": "", "story": "Package managers keep using Git as a database, it never works out"}, {"id": 739102160, "item_id": 46193885, "url": "https://news.ycombinator.com/item?id=46193885", "by": "gcr", "date": "2025-12-08", "version": null, "stance": "warn", "quote": "how can PyPI be sure it's talking to github?", "excerpt": "Yeah I was confused about that bit too. AWS and GCP's metadata servers know which instances were deployed, so they presumably have some way of verifying the instance's identity out-of-band, such as being tagged by an internal job or machine identifier. As for deploying from a trusted service without managing credentials, PyPI calls this \"trusted publishing\": https://docs.pypi.org/trusted-publishers/ From the docs: 1.", "context": "", "use_case": "", "switched_from": "", "story": "GitHub Actions has a package manager, and it might be the worst"}, {"id": 737478912, "item_id": 46092432, "url": "https://news.ycombinator.com/item?id=46092432", "by": "mulmboy", "date": "2025-11-29", "version": null, "stance": "recommend", "quote": "It does largely avoid the issue if you configure to allow only specific environments", "excerpt": "It does largely avoid the issue if you configure to allow only specific environments AND you require reviews before pushing/merging to branches in that environment. https://docs.pypi.org/trusted-publishers/adding-a-publisher/ For a malicious version to be published would then require full merge which is a fairly high bar. AWS allows similar", "context": "", "use_case": "Package publishing", "switched_from": "", "story": "Post-mortem of Shai-Hulud attack on November 24th, 2025"}]}