PyPI now requires two-factor authentication for every maintainer account
PyPI has expanded mandatory two-factor authentication to cover every account with package-upload permissions, closing the gap left by the previous policy, which only required 2FA for maintainers of the most-downloaded projects. Accounts without 2FA enabled will lose upload access until they enroll.
Why now
The policy follows several real incidents this year where attackers compromised maintainer accounts on mid-sized packages — ones popular enough to be worth targeting, but below the download threshold that triggered the earlier mandatory-2FA tier — and pushed malicious versions that were downloaded before detection.
- TOTP apps and hardware security keys (WebAuthn) are both supported
- SMS-based 2FA is not accepted, consistent with PyPI's existing stance that SMS is too easy to intercept
- API tokens scoped to a single project remain the recommended way to publish from CI, separate from the account-level 2FA requirement
If you maintain any package on PyPI, regardless of its download count, this is not optional starting now — check your account's 2FA status before your next release, since a lapsed upload permission mid-release is a worse time to discover this than now.
For consumers of packages, not just maintainers
This doesn't retroactively secure packages already compromised in past incidents, but it meaningfully raises the cost of the most common attack pattern — a phished or reused maintainer password — going forward. Pinning dependencies and reviewing lockfile diffs on upgrade remains the practical mitigation on the consuming side; 2FA reduces how often that diff has something malicious in it to catch.
Source: blog.pypi.org