The Python Software Foundation warned users this week that threat actors are trying to steal their credentials in phishing attacks using a fake Python Package Index (PyPI) website.

What PyPI is moving towards for Python packages is signed, verifiable builds where the package listed on the PyPI site is linked to a specific build and commit in your repository.

The Python Package Index (PyPI) is putting a stop to so-called “domain resurrection attacks” that have been observed in the wild before to launch cyberattacks. Domain resurrection is a supply chain ...

All-in-one Python project management tool written in Rust aims to replace pip, venv, and more. Here's a first look.