PyPI, the Python Package Index, is the main public registry for Python packages. Developers use it to publish and install libraries with tools like pip, so it often becomes the default path for adding dependencies, SDKs, and automation code to applications.
In cyber security, PyPI matters because it sits in the software supply chain: if a package is altered, typo-squatted, or otherwise compromised, attackers can deliver malicious code through a trusted install. That code runs with the same privileges as the application or build process that imports it, which can expose credentials, environment variables, or internal systems. Defenders reduce this risk with pinned versions, lockfiles, hash verification, package review, and monitoring for suspicious releases or dependency changes.