ATRIUMsearch → argument graph
Article · 2026-07-23 · 3 moments

Quoting Seth Larson

The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days. This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised. As far as we are aware this has not yet been abused, but there is no technical reason beyond that attackers weren't aware it was possible. — Seth Larson, PyPI blog Tags: packaging, python, supply-chain, pypi, s ✦ AI generated

Read original ↗
GUEST Seth LarsonHOST Simon Willison
01
Anecdote

As far as we are aware this has not yet been abused, but there is no technical reason beyond that attackers weren't aware it was possible.

Seth Larson notes that while the attack vector of poisoning old releases has not been observed in the wild, its absence is likely due to obscurity rather than technical barriers.

transcript

Seth Larson: As far as we are aware this has not yet been abused, but there is no technical reason beyond that attackers weren't aware it was possible.

explains mechanism · 1provides context · 1

03
Mechanism◆

This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised.

The 14-day restriction is a supply-chain security measure designed to prevent attackers who compromise publishing tokens from injecting malicious files into long-stable releases.

transcript

Seth Larson: This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised.

Highlight slides
PyPI Blocks Uploads to Old Releases✦ from: The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days.14-Day Restriction as Supply-Chain Defense✦ from: This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised.Why 14 Days?✦ from: The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days.Threat Model✦ from: This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised.
Related episodes
Video · a16z Podcast

Is Defense the Next Trillion-Dollar Category? | a16z American Dynamism Summit

→
Video · a16z Podcast

AI Is Learning to Hack. Faster Than We Expected.

→
Video · Syntax

Do You Read The Code? ⟡ HTTP Gets a NEW Method ⟡ Codex Gets Sol Ultra ⌁ Syntax Weekly ⌁

→