Python Package Index

Python is a programming language, that is, a way of giving a computer instructions. It is used especially often for AI software, websites, and data analysis. Anyone building something with it doesn’t have to start from zero. Other people have already published their finished code building blocks, at one central place on the internet: the Python Package Index, abbreviated PyPI. You can picture it as a giant app store, only not for phone apps, but for program building blocks. Over 600,000 such building blocks are available there, free of charge and accessible to everyone.

Why hardly any Python project can do without PyPI

Almost every modern piece of software consists for the most part of other people’s code. Anyone wanting to analyze a table doesn’t write their own table logic but downloads the pandas package. Anyone wanting to train an AI model gets PyTorch or TensorFlow. These packages have grown over years and are packed with work that you save yourself from doing. A project that uses twenty such packages is completely normal.

But this is exactly where a risk arises. When millions of programs use the same package, a great deal depends on very few people. Some important packages are maintained by a single person in their spare time. If that person drops out or loses interest, a piece of the global software landscape grinds to a halt.

Then there’s the security question. Anyone is allowed to upload something to PyPI; there is no prior content review. Attackers exploit this and upload malware under names that resemble well-known packages. If someone accidentally types “reqeusts” instead of “requests”, in the worst case they install a program that steals passwords. This trick is called typosquatting and is discovered regularly.

From the pip command to the installed package

Access runs through a tool called pip, which already comes bundled with Python. You type the command “pip install requests” into the command line. Pip then asks PyPI whether a package with this name exists. It downloads the file and places it in the right spot on the computer. After that, your own program can use this code.

Usually it doesn’t stop at one package. Many packages themselves need other packages to work. This chain is called dependencies. Pip resolves them automatically and installs everything necessary along with it. A single command can quickly turn into thirty downloaded packages.

Anyone wanting to publish something themselves packs their code into a fixed format and uploads it. This includes a unique name, a version number, and a description. The version number is important because projects often need a very specific version. An update can change things that older code relied on.

PyPI in news, studies, and AI projects

In computer science class or an online course, you’ll encounter PyPI at the latest during your first bigger project. As soon as a guide says “first install this package”, PyPI is behind it. Even with AI experiments involving image recognition or language models, the first step almost always goes through a pip command.

In tech news, PyPI mostly comes up in connection with attacks. Time and again, hundreds of fake packages are discovered and deleted. Experts then speak of an attack on the software supply chain, because the malicious code doesn’t land directly with the victim but arrives via a building block that everyone trusts. In response, PyPI now requires two-factor authentication from the maintainers of important packages.

It’s important to distinguish this from similar services in other languages. For JavaScript there’s npm, for Java Maven Central, for Rust crates.io. The principle is the same everywhere, only the language differs. Once you’ve understood the concept using PyPI, you’ll quickly find your way around there too.