# PyPI 16 Hacker News commenters recommended PyPI and 28 criticized it, November 2025 to November 2026. It was recommended in 10 of 13 months. **Verdict:** Python's official package index, recommended for its attestations and fast malware quarantines, though critics say publishing lacks 2FA and uploads cannot be replaced. ## Why people recommend it - Best-in-class attestation design (2 comments): "PyPI's implementation of attestations prefers the more ideal thing with respect to reducing the likelihood of local private key disclosure" ([source](https://news.ycombinator.com/item?id=46405729)) "PyPI is pretty best-in-class here and I think that they should be seen as the example for others to pursue." ([source](https://news.ycombinator.com/item?id=47532645)) - Quick malware quarantine response (2 comments): "pypi reacted so quickly and quarantined the package in like 30 minutes" ([source](https://news.ycombinator.com/item?id=47532924)) "this was handled pretty well all things considered" ([source](https://news.ycombinator.com/item?id=47533681)) - Simple, everywhere-available default (3 comments): "Pypi is the only OS agnostic package manager already installed on every OS." ([source](https://news.ycombinator.com/item?id=46562313)) "today it is a more "just works" experience to use PyPi instead of conda" ([source](https://news.ycombinator.com/item?id=49726937)) "you can just put it on PyPI which is everywhere nowadays" ([source](https://news.ycombinator.com/item?id=45852668)) - Well regarded versus other registries (2 comments): "Cargo, NPM, Composer and pypi are more than enough." ([source](https://news.ycombinator.com/item?id=48121255)) "Cargo (and PyPI) is undeniably better than NPM" ([source](https://news.ycombinator.com/item?id=49375063)) ## What people warn about - Weak auth: optional 2FA, long-lived tokens (3 comments): "2FA is not yet required formally logins, nor is password expiry enforced" ([source](https://news.ycombinator.com/item?id=49119773)) "Basically you enable 2FA on your account, go on the website, generate a token, store it in a .txt file and use that for the rest of your life" ([source](https://news.ycombinator.com/item?id=47552979)) "PyPI only supports 2FA for sign-in. 2FA is not a factor at all with publishing." ([source](https://news.ycombinator.com/item?id=47550431)) - Security measures seen as ineffective (3 comments): "NPM, PyPI, Cargo et. al. continue to think they can short circuit that process and still ship safe software, and they verifiably cannot." ([source](https://news.ycombinator.com/item?id=47292623)) "Instead Python gets absurdly ineffective workarounds that will probably inconvenience a few developers and will do zilch for users." ([source](https://news.ycombinator.com/item?id=49050003)) "NPM (and cargo/PyPI et. al.) continues to think it can short circuit this requirement for human labor." ([source](https://news.ycombinator.com/item?id=48360266)) - Frequent supply-chain attacks and mishaps (3 comments): "attackers are publishing "internal-package-a@999.9.9" on any public package host (NPM, PyPi, etc)" ([source](https://news.ycombinator.com/item?id=49510459)) "it's the insanely easy to attack programming language package ecosystems, like NPM, PyPI" ([source](https://news.ycombinator.com/item?id=50319659)) "There were a few mishaps with PyPI and npm - including in the past week and even today." ([source](https://news.ycombinator.com/item?id=47586579)) ## Alternatives hackers recommend - [Nixpkgs](https://hackerapproved.com/p/nixpkgs.md): 38 recommend - [Arch User Repository](https://hackerapproved.com/p/arch-user-repository.md): 34 recommend - [Arch User Repository](https://hackerapproved.com/p/aur.md): 20 recommend - [crates.io](https://hackerapproved.com/p/crates-io.md): 17 recommend - [CPAN](https://hackerapproved.com/p/cpan.md): 13 recommend ## Where to get it - [Visit the official site](https://pypi.org/) ## Cite as Hacker Approved, "PyPI", https://hackerapproved.com/p/pypi/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).