The Python Package Index (PyPI) has implemented a significant security measure to prevent malicious file uploads to existing package versions. With this new policy, uploads of new files to package releases older than 14 days are now restricted. This step is aimed at thwarting potential attacks where compromised tokens or workflows could be exploited to add harmful files to established Python packages.
Understanding the New Policy
As of July 8, 2022, PyPI’s Warehouse codebase enforces a rule that blocks uploads for any release older than two weeks. This change addresses a critical software supply-chain vulnerability by eliminating “open-ended” release possibilities. Previously, package maintainers enjoyed the flexibility of updating files for an existing release at any given time.
While this capability was beneficial for improving compatibility with new Python versions, it also posed a security risk. Attackers gaining access to API tokens or CI/CD pipelines could exploit this flexibility to introduce malicious files without altering the version number. This made detecting compromised packages during standard updates particularly challenging.
Impact and Rationale
PyPI has stated that, to its knowledge, this specific vulnerability has not been exploited by attackers in the past. However, the absence of technical barriers meant it remained a latent risk. The importance of the new rule was underscored by incidents involving popular packages like LiteLLM and Telnyx, which demonstrated the potential for supply-chain attacks.
With the new restrictions, any unauthorized file additions to older releases are effectively prevented, forcing maintainers to issue a new version if they need to support newer Python releases. This change simplifies the incident response process by ensuring all files within a release are legitimate, reducing user uncertainty regarding package safety.
Community and Future Developments
Before implementing this policy, PyPI conducted an analysis of historical publishing patterns. Among the top 15,000 packages, only 56 had added files after the initial release beyond the 14-day window, indicating minimal disruption for most maintainers. The change was also discussed at the Packaging Summit during PyCon US 2022, where it received general support.
Currently, this restriction serves as a practical security measure, but PyPI advises against considering it a formal guarantee of a release’s state. The platform plans to introduce more comprehensive definitions and controls through the proposed Upload 2.0 API and PEP 694, which will provide clearer semantics around open and closed releases.
This proactive step by PyPI significantly mitigates the risk of package poisoning, ensuring a safer environment for Python developers globally.
