Simon Willison's Weblog

Quoting Seth Larson

6.0内容质量

TL;DR · AI 摘要

PyPI实施14天文件上传限制以防止旧版本被毒害，该政策由Seth Larson在博客中宣布。

核心要点

  • PyPI禁止上传超过14天的文件到发布版本
  • 该措施旨在防范令牌泄露后的供应链攻击
  • 政策实施后尚未发现实际滥用案例

结构提纲

按章节快速跳转。

  1. §引言

    介绍PyPI实施新安全政策的背景和目的。

  2. ·政策细节

    说明14天文件上传限制的具体实施方式。

  3. ›安全考量

    分析该政策对防范供应链攻击的作用。

思维导图

用一张图看清主题之间的关系。

查看大纲文本（无障碍 / 无 JS 友好）
  • PyPI安全政策更新
    • 核心政策
      • 14天文件限制
    • 安全目标
      • 防止供应链攻击
    • 相关事件
      • OpenAI-Hugging Face事件

金句 / Highlights

值得收藏与分享的关键句。

#PyPI#Python#安全#软件供应链
打开原文

A quote from Seth Larson

Simon Willison’s Weblog

Subscribe

#smallhead

Sponsored by:

Cursor — Delegate engineering tasks to Cursor Cloud Agents—even while your laptop is closed.

Try Cursor & get 50% off your first month

23rd July 2026

The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days. This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised. As far as we are aware this has not yet been abused, but there is no technical reason beyond that attackers weren't aware it was possible.

— Seth Larson , PyPI blog

Posted

at 4:50 am

Recent articles

  • OpenAI’s accidental cyberattack against Hugging Face is science fiction that happened - 22nd July 2026
  • A Fireside Chat with Cat and Thariq from the Claude Code team - 21st July 2026
  • Kimi K3, and what we can still learn from the pelican benchmark - 16th July 2026

#primary

This is a quotation collected by Simon Willison, posted on 23rd July 2026 .

packaging

51

pypi

49

python

1,268

supply-chain

20

seth-michael-larson

6

.metabox

#secondary

#wrapper

  • Disclosures
  • Colophon
  • ©
  • 2002
  • 2003
  • 2004
  • 2005
  • 2006
  • 2007
  • 2008
  • 2009
  • 2010
  • 2011
  • 2012
  • 2013
  • 2014
  • 2015
  • 2016
  • 2017
  • 2018
  • 2019
  • 2020
  • 2021
  • 2022
  • 2023
  • 2024
  • 2025
  • 2026