Quoting Seth Larson

Per Simon Willison's Weblog, PyPI—the main repository for Python packages—now rejects uploads of new files to releases older than fourteen days. The rule is meant to protect stable, long-established versions from being poisoned by attackers with compromised publishing credentials. Seth Larson, a PyPI maintainer, notes the vulnerability hasn't been exploited yet, but the risk was always there.

Listen to this story

Hear this and more stories in a personalized audio briefing.

Open The Chonkerton