---
title: "PyPI 实施14天上传期限以防止供应链投毒"
source: "Simon Willison 博客（Atom）"
source_tier: "t2"
url: "https://simonwillison.net/2026/Jul/23/seth-larson/#atom-everything"
permalink: "https://feed.astralor.com/items/itm_e36aa4d640d1bfa566ce427c"
published: "2026-07-23T04:50:36.000Z"
score: 80
channel: "tech"
tags: ["PyPI","Python","上传限制","供应链安全"]
---

# PyPI 实施14天上传期限以防止供应链投毒

## AI 点评

> 这条消息对 Python 生态至关重要。如果你管理任何 PyPI 项目，请立即检查你的发布流程——14天窗口意味着你不能再在旧版本上修补或覆盖文件，需要发布新版本。对安全团队而言，这是供应链安全的最佳实践，值得其他包管理器借鉴。

## 速览

Python 包索引（PyPI）宣布不再接受对超过14天发布的版本上传新文件。该措施旨在防止因发布令牌或工作流泄露而导致的旧版投毒攻击。截至目前尚未发现实际利用案例，但攻击者之前未意识到该漏洞的存在。此举加强了 Python 软件供应链的安全防护。

## 关键点

- PyPI 禁止向超过14天的版本上传新文件。
- 该措施防止已稳定的旧版因凭据泄露而被投毒。
- 目前未发现利用案例，但此前存在技术可能性。
- 提升 PyPI 对供应链攻击的防御能力。

## 全文

The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days. This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised. As far as we are aware this has not yet been abused, but there is no technical reason beyond that attackers weren't aware it was possible. — Seth Larson, PyPI blog Tags: packaging, python, supply-chain, pypi, seth-michael-larson

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_e36aa4d640d1bfa566ce427c