Defense in Depth: A Practical Guide to Python Supply Chain Security

Why this matters

A new practical guide aimed at Python maintainers and consumers argues that you should layer controls and not trust any single defense. PyPI hosts roughly 743,000 packages as of March 2026, and typical projects pull in dozens of transitive dependencies you didn’t even pick. Patches lag. Attackers exploit that gap. The guide’s author speaks from experience — maintaining multiple PyPA projects and running corporate package-hosting infrastructure — and walks readers through measures that deliver quick wins and long-term resilience.

Real incidents make the risk painfully concrete. It has been reported that the ctx package was hijacked in 2022 after an expired maintainer email allowed an attacker to push malicious updates that exfiltrated AWS credentials. It has also been reported that the widely used Ultralytics package was compromised in December 2024 after attackers stole a PyPI upload token and slipped a crypto miner into several releases — reportedly reaching millions of downloads. And maintainers faced a July 2025 phishing campaign that allegedly spoofed PyPI-related addresses to seize credentials. Gut punch? Thousands of developers can install malware with a single pip command.

Practical steps — start small, scale up

The guide’s prescription is refreshingly pragmatic. Start with linting: run Ruff with security rules to catch risky code early. Pin every dependency with cryptographic hashes using uv lock or uv pip compile --generate-hashes so packages can’t be swapped under you. Add pip-audit in CI to catch known CVEs before they reach production. Produce SBOMs with CycloneDX so when the next Ultralytics-style compromise drops, you can answer “are we affected?” in minutes instead of days. For publishers: ditch long-lived API tokens and adopt Trusted Publishing with OIDC and Sigstore attestations; for orgs operating mirrors, a short 7‑day delay can let the community be your canary — but only if you’ve got the ops to run it.

Nothing here is a silver bullet. Hash pinning won’t save you from a malicious package you installed on day one. Scanners miss zero‑days. Attestations prove origin, not innocence. That’s the point: belt-and-suspenders. Layered controls catch each other’s misses. Start with linting and pinning for immediate relief, then add scanning, SBOMs, and finally the advanced signing/attestation workflows as you mature.

What’s the takeaway? Supply-chain security is an operational problem, not just an academic one. Small, consistent steps reduce risk dramatically. So ask yourself: when the next supply-chain shock arrives, will you be able to answer “are we affected?” quickly — or will you be scrambling?

Sources: bernat.tech, Lobsters