# Seth Larson, "pip v26.1 adds support for relative dependency cooldowns" (27 Apr 2026): recompute, 26 Oct 2026

This supports the post. Of 797 new PyPI projects that OpenSSF's malicious-packages database lists as malware, created from 27 April to 19 October 2026, nearly half were gone from the index within an hour of their first upload and 85% within a day.

The sentence: "The vast majority of malware and supply chain attacks published are detected and removed within hours of being uploaded to the index."

Our path: every malicious-package entry for PyPI in OSV's export of 26 October 2026 (OpenSSF malicious-packages, ids MAL-…), matched to PyPI's public change log (XML-RPC changelog_since_serial, 6,585,813 events, 16 April to 26 October). Clock starts at the project's first file upload; it stops at the first "project quarantined" or "remove project" event after that.

| Gone from the index within | Projects | Share of 797 |
|---|---|---|
| 1 hour | 376 | 47% |
| 4 hours | 548 | 69% |
| 24 hours | 675 | 85% |
| 7 days | 728 | 91% |
| No takedown in the change log by 26 October | 47 | 6% |

- Median 59 minutes from first upload to takedown, for the 750 taken down. 646 of them were quarantined before they were deleted.
- For the cooldowns: a one-day cooldown would have outlasted the takedown of 675 of the 797; seven days, 728.
- Of the 47 with no takedown event, 3 are now gone and 44 were still installable on 26 October. 16 of those 44 are one 6 October campaign of near-identical "tts" packages, which download and run code from a URL the user passes in; the package itself carries no payload and runs nothing on install or import. OpenSSF's sources for the 44: kam193 21, Amazon Inspector 17, ReversingLabs 3, none listed 3. We list them as OpenSSF does, without judging them ourselves; PyPI may have looked at them and disagreed.

Not covered: malware no one has reported to OpenSSF's list; malicious releases pushed into existing projects (a different clock, not checked here); projects created after 19 October.

Files: fetch_changelog.py, analyze.py, rows.csv (one row per project: first upload, takedown, how, hours), still_live.csv (the 47, with OpenSSF's summary), summary.json, SHA256SUMS for the change log and the OSV export.