In July, we announced a series of planned updates to the PyPI user interface. Shaped by user research with members of the Python community, the updates aim to improve how we surface security signals and display package details.
With the rapid growth of the Python ecosystem, PyPI has become an increasingly attractive target for malicious actors. In response, the PyPI team has delivered many security features while taking a more active role in helping PyPI users assess and understand package security.
Digital attestations, introduced in 2024, are an example of this effort, providing a verifiable record of a release file's provenance (where it came from). However, provenance and attestations are still unfamiliar concepts for many PyPI users, and PyPI's interface did little to communicate their meaning, importance, or limitations.
