Loading story…
PyPI has begun rejecting uploads of new files to package releases more than 14 days old, a security change designed to make it harder for attackers to poison long-stable versions after compromising a project's publishing token or CI workflow. The policy was driven in part by supply-chain incidents involving the LiteLLM and Telnyx packages, whose March 2026 compromises were tied to a mutable reference in the Trivy GitHub Action.
PyPI maintainers said the operational impact should be limited: analysis found that only 56 of the top 15,000 packages uploaded a Python 3.14-compatible wheel more than 14 days after the original release. The approach gained support during discussions around PEP 740 and at the 2026 Packaging Summit, where participants favored publishing a new package version instead of modifying an older release; the implementation by Seth Larson was merged on July 8.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
At the 2026 Packaging Summit at PyCon US 2026, PyPI maintainers and community participants concluded it was acceptable to require projects to publish a new version rather than add files to older releases. The discussion built support for a 14-day cutoff on new file uploads.
PyPI announced that it now rejects uploads of new files to package releases older than 14 days to reduce the risk of attackers poisoning long-stable releases after a compromise. Maintainers said analysis suggested the operational impact would be limited.
A patch implementing PyPI's new rule to reject uploads of new files to releases older than 14 days was merged on July 8, 2026. Seth Larson implemented the change.
In March 2026, the LiteLLM and Telnyx package compromises highlighted a supply-chain risk tied to a mutable reference in those projects' use of the Trivy GitHub Action. PyPI later cited these incidents as a motivator for tightening release upload rules.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Python Software Foundation disclosed a **critical authentication bypass** in the `python.org` release management API that could have let attackers forge administrator-level requests and modify Python release metadata. The flaw, reported by Splitline Ng of DEVCORE and confirmed by the Python Security Response Team, could have enabled changes to download and verification URLs for official Python installers, creating a path to distribute tampered files through trusted `python.org` infrastructure. The vulnerable logic reportedly dated back to 2014, affecting the release pipeline for more than a decade, but maintainers said post-incident forensics found **no evidence of exploitation**. The PSF patched the issue rapidly, with production fixes deployed within 24 hours and broader remediation completed within 48 hours, while also disabling risky API behavior and tightening release controls. Additional hardening included stricter URL validation, mandatory HTTPS enforcement, negative authentication test coverage, longer log retention, and stronger provenance measures around release artifacts, including emphasis on **Sigstore** alongside existing **PGP** signing. A subsequent Trail of Bits review funded by OpenAI reportedly found no additional authentication or authorization flaws, and the Foundation said the changes were designed to reduce the risk of unauthorized modification of Python downloads distributed via official channels.
Jul 12, 2026
Security researchers have identified a vulnerability in legacy Python packages distributed via PyPI, stemming from outdated bootstrap scripts that reference the now-defunct domain `python-distribute[.]org`. These scripts, associated with the `zc.buildout` tool, automate the download and installation of dependencies, including the obsolete 'Distribute' package, by fetching installation scripts from the aforementioned domain. Since the domain is currently up for sale and managed for ad revenue, an attacker who acquires it could serve malicious code to any environment executing these legacy bootstrap scripts, potentially compromising the software supply chain. The affected packages include widely used libraries such as `tornado`, `pypiserver`, `slapos.core`, `roman`, `xlutils`, and `testfixtures`, among others. While the vulnerable code is largely unused in modern development, it may still be present in legacy production environments, posing a latent risk. The issue highlights the ongoing dangers of abandoned infrastructure and the importance of auditing dependencies and installation scripts, especially in open-source ecosystems where legacy code may persist unnoticed.
Jun 29, 2026
Security reporting from Palo Alto Networks, GitHub, and Cisco Talos shows software supply-chain abuse continuing to intensify, with open-source ecosystems facing rising volumes of vulnerabilities, advisories, and malware. Incident responders said attackers increasingly target developers and build environments because they provide access to source code, CI/CD pipelines, cloud infrastructure, and enterprise endpoints, turning package repositories into an efficient initial-access vector. Cisco Talos detailed how malicious Python packages can execute payloads during installation as well as at runtime by abusing build hooks and package contents, including `setup.py` command classes, `.pth` files, `sitecustomize` and `usercustomize` hooks, `PYTHONPATH` manipulation, import-time code in `__init__.py`, `__main__.py`, and hijacked entry points. The research cited real-world supply-chain cases including TeamPCP activity, the `litellm` compromise, VIPERTUNNEL abuse of site hooks, and the lightning compromise, while defenders were urged to harden package intake with lock files, cryptographic hashes, isolated build environments, SBOM generation, dependency cooldowns, package auditing, and PyPI Trusted Publishing via OIDC.
Jul 14, 2026