Python Supply Chain Security: 8 Things That Happen After pip install | by Yang Zhou | TechToFreedom | May, 2026 | MediumSitemapOpen in appSign up<br>Sign in
Medium Logo
Get app<br>Write
Search
Sign up<br>Sign in
Mastodon
TechToFreedom
Technology gives us more and more freedom. Start learning today.
Member-only story
Python<br>Python Supply Chain Security: 8 Things That Happen After pip install
Dependency pinning, lock files, trusted publishing, malicious packages, CI/CD secrets, and what modern tooling changes.
Yang Zhou
13 min read·<br>Just now
Listen
Share
Press enter or click to view image in full size
Image from Wallhavenpip install requests looks innocent.<br>It is only one command.<br>However, after pressing Enter, we are making a trust decision for much more code than we can see on the screen.<br>pip may resolve transitive dependencies, download wheels or source distributions, build packages, install executable files, and put new Python modules into our runtime.<br>If this happens in CI/CD, it may happen next to GitHub tokens, PyPI tokens, cloud keys, deployment credentials, and all kinds of secrets we forgot existed.<br>In short, Python supply chain security means controlling what gets installed, verifying where it came from, and limiting what it can steal if the package is bad.<br>I’m writing this because the old advice, “just pin your dependencies,” is no longer enough.<br>Pinning is important.<br>But pinning alone doesn’t protect publishing credentials, CI/CD secrets, malicious package names, source builds, or compromised…
Published in TechToFreedom<br>1.6K followers<br>·Last published just now
Technology gives us more and more freedom. Start learning today.
Written by Yang Zhou<br>14.6K followers<br>·209 following
Full-Stack Engineer
Help
Status
About
Careers
Press
Blog
Privacy
Rules
Terms
Text to speech