PyPI has completed its redesign of project pages featuring clearer security signals, including a new Security tab that displays release provenance states and per-file digital attestations. The update was developed in partnership with Kabu Creative based on the OpenSSF Attestations Style Guide, aiming to help users better assess package security in response to growing supply chain threats.
Background
PyPI serves over 500,000 packages and has faced increasing supply chain attack concerns, having introduced digital attestations in 2024 to verify release provenance but struggling with low user awareness.
- Source
- Lobsters
- Published
- Nov 10, 2026 at 05:45 AM
- Score
- 7.0 / 10