Python Package Index (PyPI), the official third-party software repository for the Python programming language, has temporarily restricted the ability for users to sign up and submit new packages until further notice. This change was made by the administrators of PyPI. PyPI, the official third-party repository for open-source Python packages, has implemented new security measures in response to an unprecedented increase in malicious software activity. It has placed a temporary hold on the registration of new users and the uploading of projects. This surprising step is being made with the intention of preventing further load on the operations of the registry brought on by the increasing number of fraudulent users and programs.
Even if the administrators have not revealed the identities of the individuals responsible for these hostile activities, the suspension of new registrations is an essential preventative precaution. This stopgap measure is intended to discourage potential opponents until a better long-term solution can be found. It was brought to everyone’s attention by the administration that “while we re-group over the weekend, new user and new project registration is temporarily suspended.” As of the 20th of May, the Python Package Index, often known as PyPI, was released. They have issued an incident notification in which they announce the temporary cessation of signups for new users and projects. According to the notification, “New user and project name registration on PyPI is temporarily gets suspension.” The administrators of the register have expressed their inability to react effectively to the growing number of fraudulent behaviors. This occurred within a decent amount of time, despite the fact that numerous PyPI admins were absent due to being on leave.
As is the case with many other open-source registries, the Python Package Index (PyPI) has been subject to exploitation at the hands of malicious software distributors. Experts discovered that a malicious PyPI package called “colorful” was spreading a harmful program known as the “Color-Blind” malicious software in the month of March 2023.
It is clear that PyPI is dedicated to preserving the integrity and safety of the Python package ecosystem, as seen by its decision to temporarily halt the registration of new users and the uploading of new projects. PyPI wants to safeguard its users and stop any further erosion of the platform’s reputation for dependability, thus it is taking proactive measures to deal with the recent uptick in harmful actions.
It is essential to take into account that the current maintainers of Python packages that are already published on the PyPI registry are not expected to be impacted by this temporary suspension. They will not be prevented from publishing updated versions of their artifacts at any point in the future.
Information security specialist, currently working as risk infrastructure specialist & investigator.
15 years of experience in risk and control process, security audit support, business continuity design and support, workgroup management and information security standards.
