PyPI launches redesigned pages with security signals
Original: PyPI's redesigned project pages with clearer security signals are now live
Why This Matters
Clearer provenance signals help developers catch supply chain attacks earlier.
PyPI has rolled out a redesigned project detail page featuring a dedicated security tab, provenance states, and per-file attestation display, completing a UI overhaul announced in July 2026.
PyPI's redesigned project pages are now live, completing a UI initiative announced in July 2026 and shaped by user research with the Python community. The centerpiece is a new Security tab on each project detail page, giving users a dedicated place to verify where release files came from.
The redesign introduces formal 'provenance states' calculated per release. 'Full Provenance' means every release file carries an attestation — either a PyPI Publish attestation (confirming the file came from a Trusted Publisher) or a SLSA Build Provenance attestation (linking the file to a specific source commit, build platform, and instructions). 'No Provenance' means no files have attestations, which is common for older packages or projects not yet using Trusted Publishing — and does not automatically signal malicious intent.
The UI also surfaces warning states: Incomplete Provenance, Inconsistent Provenance, Change of Provenance, and Loss of Provenance, giving users finer-grained context rather than a binary safe/unsafe flag. Users can review attestation metadata directly in the UI or follow a transparency log link.
The work was done in partnership with Kabu Creative and implements recommendations from the OpenSSF Attestations Style Guide. Digital attestations themselves were introduced to PyPI in 2024. The release files and release history sections were also redesigned as part of the update.