If you’re using uv and concerned about recent PyPI package compromises, there’s a simple step worth adding to your workflow: verify package hashes before installing.
The advice circulating from <a href="https://twitter.com/__mharrison__" target="_blank" rel="noopener nofollow">@mharrison</a> is straightforward - pin your dependencies with hash verification so that even if a package on PyPI gets swapped out or tampered with, your install will fail loudly rather than silently pulling down something malicious.
This is a good habit regardless of which installer you use, but it’s especially relevant right now given the recent supply chain incidents targeting the Python ecosystem.

Collections

When using uv as a Python package installer, you can protect against PyPI supply chain attacks by pinning dependencies with hash verification. This ensures that if a package is tampered with or swapped out on PyPI, the installation will fail loudly instead of silently installing malicious code. The practice is recommended broadly but is especially timely given recent supply chain incidents in the Python ecosystem.

How to verify PyPI package integrity when using uv