Agentic data science with the Data Agent Kit
cloud.google.com·6h ago
Data Science
Simon Willison's Blog·Jul 23·5 min read
Quoting Seth Larson
TL;DR
PyPI has implemented a new policy that prevents the upload of files to releases older than 14 days, aimed at enhancing security against potential token compromises. This measure is proactive, as there have been no known abuses of this vulnerability yet.
✦ Why It Matters
Review your project's release management practices to ensure compliance with PyPI's new upload policy.
Key Takeaways
- Update your release process to comply with the 14-day rule.
- Monitor your publishing tokens for any unauthorized access.
- Educate your team about the risks of compromised workflows.
- Consider implementing additional security measures for your projects.
Full Summary
The Python Package Index (PyPI) has introduced a restriction that disallows the uploading of new files to any release that is older than 14 days. This decision was made to mitigate the risk of 'poisoning' older, stable releases, which could occur if an attacker gains access to a project's publishing tokens or workflows.
Although there have been no reported incidents of this vulnerability being exploited, the policy serves as a proactive measure against potential threats. By enforcing this rule, PyPI aims to enhance the security of its ecosystem and protect developers from malicious alterations to their packages.
This change reflects a growing awareness of security risks in software development and the importance of safeguarding open-source projects.