PyPI Security Best Practices

Skill by ara.so — Security Skills collection.

This skill provides comprehensive guidance on securing Python package installations from PyPI, covering supply chain attack mitigation, dependency verification, and secure development practices for both uv and pip package managers.

Overview

PyPI security best practices help protect against supply chain attacks like the LiteLLM/Telnyx incident (119k+ malicious downloads in under 3 hours) and other compromised package scenarios. This guide covers secure package installation, dependency management, and development environment hardening.

Key Security Principles:

• Prefer binary-only installations to avoid arbitrary code execution
• Implement dependency cooldowns to avoid newly-published malicious packages
• Pin dependencies with cryptographic hash verification
• Use deterministic installations and prevent dependency confusion
• Scan for vulnerabilities and verify package health

Installation