#PyPI

PyPI serves billions of requests daily- but sustaining it isn’t free. The PSF joined the OpenSSF & others in calling for organizations to invest in sustainable open infrastructure. Learn what this means for #PyPI, the PSF, & how our community can pitch in:

#PyPI runs on ~zero AWS cost thanks to @FastlyDevs caching 99% of traffic + @AWSOpen credits covering the rest. Huge thanks to both! But 2026 broke an 8-year streak: AWS spend is up 69% YoY as agents & CI runs surge. Jacob Coffee, PSF Director of Engineering, on what's changing: #Python

🔎🔐 #PyPI has completed its second external #security audit! Thanks to Sovereign Tech Agency for funding, @trailofbits for the audit, and @AlphaOmegaOSS for supporting rapid remediation. Find the full report on the Trail of Bits publication page. #Python

The PSF's Strategic Plan full draft is available and we want your feedback. After sharing high-level goals in May, we're opening a 3-week community feedback window. Read the full draft and tell us: Are these the right goals? Is anything missing? #Python #PyPI

Great talk by Vuyisile Ndlovu discussing PyPI In a box: Using a #RaspberryPi as a portable #PyPI server at #UbuntuSummit

🎉 Cheers and huge thanks to @Meta_Engineers for 10 years running as a PSF sponsor! Their support has helped fund #PyPI security work, the Developer in Residence program, and community events like #PyConUS. If #Python powers your organization, consider giving back by sponsoring the PSF 💛💙

This year marks Meta’s 10th consecutive year as a sponsor of @ThePSF! Python remains the most used programming language across our engineering stack, powering the backends of Instagram and Threads alongside our AI research infrastructure. By supporting the PSF, we aim to help ensure that Python remains robust, innovative and accessible for generations of engineers to come. Read our full reflection on our long-term commitment to Python:

We've discovered malicious #npm & #PyPI packages on public registries, 65% previously unknown. Attacks include .env credential theft, crypto wallet stealing, RCE droppers, & #MCP server backdoors targeting AI developers. Details on the extracted malware at

The #TeamPCP campaign continues. The telnyx #PyPI package (versions 4.87.1 & 4.87.2) with ~1M monthly downloads was compromised. What's new this time: WAV steganography. The payload hides an XOR-obfuscated binary inside audio frames, downloads it from C2 at import time, and persists on Windows via msbuild.exe in Startup. Linux/macOS gets a credential harvester with AES-256 + RSA encryption. The attackers even pushed a bugfix release (4.87.2) within hours of 4.87.1 failing due to a casing error. Operational iteration, live. A good reminder of why writing detections around behavioral patterns rather than point-in-time indicators matters. Generic rules from years back still hold against new techniques. Rune AI, our internal LLM analysis layer, surfaces the same verdict for efficient triage. IOCs & analysis:

PyPI now has an improved way to report #malware, via #PyPI itself! Available on web and preview beta API. Learn more and sign up to help test:

The #Python Package Index now rejects new files published to releases older than 14 days. This mitigation prevents long-stable releases from being poisoned in case publishing tokens or workflows of #PyPI projects are compromised. #security #supplychain

I was annoyed of having to write README files for my projects. So I went ahead and created a CLI tool to auto-generate README files for any project regardless of programming language! 📜✨ It creates a comprehensive README based on your project. Check it out on #PyPI and #npm

Looking back at 2023 @mikefiedler discovered some impressive metrics that we want to share! @fastly #PyPI #pytho

📢 The Python Software Foundation is hiring! 🐍 We’re looking for a #PyPI Sustainability Engineer (full-time, 1-year contract, globally remote 🌍). If you love #Python & open source, this is your chance to make an impact at scale. 👉 Apply: #OpenSource

Internet is dead, no more #stackoverflow, #reddit, #pypi,... lets see who is still able to write code.

The PSF is looking for a PyPI Support Specialist to join the team! This is a remote position with 2-4 hours/week overlap with US Eastern/Central work hours. Please share this posting with your colleagues and networks. #python #pypi

On this #PiDay, we want to remind you that our love for #python is infinite! Give the unique and unrepeatable love of Python* to yourself or a friend 💙💛 grab the @nostarch Humble Bundle today! * Pairs well with pie 🥧, pizza 🍕, and #pypi 🐍

We are thrilled for more amazing proposals from you. 📜 Keep an eye 👀 on our proposal list. Do you have something unique to share? ✍️ Head over to and get your idea listed too! #Python #CPython #pypi #security #Django #Flask #DataScience #PyConIndia2021

#pyOneNote v0.0.1 is now on #PyPI pip install pyonenote It prints: 1⃣ header fields 2⃣ all metadata (i.e. all PropertySets such as jcidEmbeddedFileNode, jcidImageNode) 3⃣ embedded files and also dumps all embedded files related

Let me introduce you to #pyOneNote v0.0.1; a pure python library to parse #one file format: Covers 20 out of 38 FileNode types E.g.: .one in 835239c095e966bf6037f5755b0c4ed333a163f5cc19ba0bc50ea3c96e0f1628

Hudson River Trading (HRT) has joined the Python Software Foundation as a Visionary Sponsor–the PSF's highest tier! HRT's support will go toward CPython development, PyPI infrastructure, community programs, and ecosystem security. Welcome, @WeAreHRT! #Python #PyPI

🐍 #Python developers, beware! Malicious package on #PyPI uses Unicode to evade detection and deploy info-stealing #malware! 📢 Learn more: #cybersecurity #hacking #infosecurity #coding