PyPI's redesigned project pages with clearer security signals are now live - The Python Package Index Blog

PyPI has launched redesigned project pages featuring a dedicated security tab that displays per-file provenance attestations and release-level provenance states, built with Kabu Creative and following the OpenSSF Attestations Style Guide. The new interface classifies releases as having "full provenance" when 100% of files carry PyPI Publish or SLSA Build Provenance attestations, or "no provenance" when no files do, and adds provenance warnings to flag files that may not have come from project maintainers. The change matters because PyPI, the default package index for the Python ecosystem, has become an increasingly attractive target for malicious actors as the ecosystem grows, and provenance and attestation concepts were previously poorly communicated in the UI. Digital attestations, introduced in 2024, provide a verifiable record of a release file's origin, but PyPI said its interface did little to explain their meaning, importance, or limitations. PyPI advises users to treat "no provenance" as unverified rather than malicious and to rely on surrounding trust signals such as maintainer history and release patterns. Package maintainers are encouraged to adopt Trusted Publishing with a publisher that generates attestations for their next release.