A quote from Seth Larson
Simon Willison’s Weblog
Subscribe
23rd July 2026
The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days. This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised. As far as we are aware this has not yet been abused, but there is no technical reason beyond that attackers weren't aware it was possible.
— Seth Larson, PyPI blog
Recent articles
OpenAI’s accidental cyberattack against Hugging Face is science fiction that happened - 22nd July 2026
A Fireside Chat with Cat and Thariq from the Claude Code team - 21st July 2026
Kimi K3, and what we can still learn from the pelican benchmark - 16th July 2026
This is a quotation collected by Simon Willison, posted on 23rd July 2026.
packaging 51
pypi 49
python 1,267
supply-chain 20
seth-michael-larson 6
Disclosures
Colophon
©
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026