PyPI Enhances Security with New Release Attestations Feature

• •PyPI launched a security tab to display release provenance and digital attestations.
• •The feature helps developers verify the origins of release files to enhance package security.
• •Warnings are provided for releases with incomplete provenance or differing file sources.

The Python Package Index (PyPI) has introduced a new security tab on its project pages to enhance the visibility of release provenance and digital attestations. This feature allows developers to verify the origins of release files, which can help in assessing the security of packages. The security tab indicates whether each file in a release has a digital attestation, which provides verifiable information about how the file was published. Users can see warnings for releases with incomplete provenance or when files originate from different repositories. This update is part of PyPI's ongoing efforts to improve security in response to the increasing attractiveness of the platform to malicious actors. The changes were finalized and went live on November 6, 2026, following user research and recommendations from the OpenSSF Attestations Style Guide. The new interface aims to clarify the importance and limitations of provenance and attestations for users unfamiliar with these concepts.