4 billion downloads a day run through @pypi. A missing permission check let any org member invite new owners. One of 14 findings from our second audit.
https://blog.pypi.org/posts/2026-04-16-pypi-completes-second-audit/

]]>https://board.circlewithadot.net/topic/33b3bd9a-5e04-4036-af3f-c0b551faf56d/4-billion-downloads-a-day-run-through-@pypi.RSS for NodeFri, 15 May 2026 08:26:38 GMTThu, 16 Apr 2026 17:47:01 GMT60