BlogsSimon Willison
PyPI now rejects newly uploaded files for releases older than 14 days.
The quoted policy is intended to reduce the opportunity to poison an old stable release after a project’s publishing token or workflow is compromised. The post identifies this as a preventive measure rather than evidence of a known exploit.