# PyPI project page redesign: Security tab shows package provenance and flags anomalies

- Link: https://blog.pypi.org/posts/2026-11-06-ui-updates-complete/
- Discussion: https://startupxo.com/en/1391/
- Posted by startupxo at 2026-11-14T18:22:38.555Z
- 0 points, 0 comments, kind story, origin curated
- Written in ko, machine translated to en

## Summary

- PyPI, the Python package repository, added a new Security tab to project pages. For each file, you can view records (provenance attestations) proving who built the file you are about to download and where.
- If every file has an attestation, the page shows full provenance. If none do, it shows no provenance. PyPI explains that none does not mean malicious, only that the origin cannot be cryptographically verified.
- If only some files have attestations, the source repository differs from the previous release, or attestations disappear, a warning appears at the top of the page. Since this could be an account takeover, PyPI recommends checking before installing.
- The release files tab gained search and filters, and the release history shows the number of files and the provenance status. This work was implemented by Kabu Creative with OpenSSF funding.

## Sources

- Hacker News: https://news.ycombinator.com/item?id=50497892 (111 points, 39 comments, checked 2026-11-14T18:21:50Z)

## Comments (0)

No comments yet.

JSON: https://startupxo.com/api/v1/item.json?id=1391&lang=en