PyPI now rejects file uploads to releases older than 14 days

The Python Package Index, known as PyPI, now automatically rejects new file uploads for any software releases that are older than fourteen days.

This security measure was introduced to stop bad actors from poisoning old and long-stable software releases if the publishing tokens or workflows belonging to PyPI projects ever become compromised.

According to Seth Larson from the PyPI blog, while there is no current evidence that attackers have actually exploited this specific vulnerability yet, no technical barriers were previously stopping them other than a lack of awareness that the method was possible.