Under the hood, PyPI is built out of multiple components, including third-party dependencies that are themselves hosted on PyPI. cabotage: PyPI’s continuous deployment infrastructure, enabling GitOps-style deployment by the PyPI administrators During our review, we uncovered a number of findings that, while not critical, could potentially compromise cabotage’s availability and integrity, as well as the availability and integrity of the containers that it builds and deploys.