PyPI Blocks New File Uploads on 14-Day-Old Releases to Prevent Package Poisoning Attacks

PyPI implemented a security change that blocks new file uploads to package releases older than 14 days to prevent attackers from silently adding malicious files to trusted package versions after compromising maintainer tokens or CI/CD workflows; the measure was motivated by past supply-chain compromises (e.g., LiteLLM and Telnyx) and was judged to have minimal impact on most maintainers after review of historical publishing patterns.