PyPI 拒绝向超过14天的发布上传新文件

Python 包索引 PyPI 实施新安全策略，禁止向超过14天的旧发布上传新文件，以防范因凭证泄露导致的供应链投毒攻击。

• PyPI 现在会拒绝所有上传到超过14天前创建的发布版本的新文件。
• 该限制旨在防止攻击者在项目发布凭证或工作流被攻陷后，向已成稳定的旧版本注入恶意代码。
• 据 PyPI 官方表示，目前尚未发现该漏洞被实际利用的案例。
• 该漏洞存在的根本原因是缺乏技术阻止措施，而不仅仅是攻击者未意识到其可能性。
• 该措施由 PyPI 团队成员 Seth Larson 在官方博客中公布。

• The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days.
• This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised.
• As far as we are aware this has not yet been abused, but there is no technical reason beyond that attackers weren't aware it was possible.