PyPI's redesigned project pages with clearer security signals are now live

In July, PyPI announced a series of planned UI updates to improve how it displays security signals and package details. The updates are now live, providing clearer security signals for users. With the Python ecosystem's rapid growth, PyPI has become more attractive to malicious actors, prompting the team to deliver security features and take a more active role in helping users assess package security.

Digital attestations, introduced in 2024, provide a verifiable record of a release file's provenance. However, these concepts were still unfamiliar to many PyPI users, and the interface lacked clarity on their meaning and importance. In response, Kabu Creative partnered with PyPI to implement recommendations from the OpenSSF Attestations Style Guide, resulting in clearer security signals on project pages.

The new security tab shows release provenance states and displays per-file attestations, helping users verify the origin of release files. Release provenance states can be "All attestations," "Partial attestations," or "No provenance," indicating the presence or absence of attestation metadata. When there is no provenance, users should rely on trust signals such as maintainer history and release patterns.

Provenance warnings help identify files that may not have originated from the project maintainers, which can indicate compromised pipelines or account takeovers. PyPI has also updated the project detail page, release files tab, and release history tab to provide more information about release files, provenance states, and release status.