Shaped by user research with members of the Python community, the updates aim to improve how we surface security signals and display package details. We're pleased to share that this work is now complete and live on PyPI. With the rapid growth of the Python ecosystem, PyPI has become an increasingly attractive target for malicious actors.
In response, the PyPI team has delivered many security features while taking a more active role in helping PyPI users assess and understand package security. Digital attestations, introduced in 2024, are an example of this effort, providing a verifiable record of a release file's provenance (where it came from). However, provenance and attestations are still unfamiliar concepts for many PyPI users, and PyPI's interface did little to communicate their meaning, importance, or limitations.
To address this, PyPI partnered with Kabu Creative to bring clearer security signals to the PyPI UI, implementing the recommendations developed in the OpenSSF Attestations Style Guide. Here's a look at what's changed, what it means for you, and what actions you can take. The new security tab communicates release provenance states and displays per-file attestations, giving you a dedicated place to verify where the release files came from.
