#package-security

PyPI stops accepting late file uploads to releases older than 14 days

PyPI will no longer accept new files uploaded to a release once that release is more than 14 days old, closing a stealth path a compromised publishing token could otherwise use to graft malicious code onto an established package. PyPI has said it is not yet aware of the technique being used in a real attack.