A quarantined PyPI project or release is not installable by clients. Its maintainers cannot change it, and PyPI administrators must review it before it can be restored. If a dependency you use is quarantined, installs of it fail, so check why before looking for a workaround.
What PyPI says
The PyPI help pages state that while in quarantine the project or release is not installable by clients, cannot be modified by its maintainers, and needs review by PyPI administrators before restoration. A maintainer who thinks a project was flagged by mistake is told to contact the PyPI security address listed on that page.
The page does not set a time for review, so do not plan around one. Quarantine is a holding state, not a verdict.
What you may see in your build
| Symptom | Likely cause |
|---|---|
| Install fails for a pinned version that worked before | Release quarantined |
| Package not found for a name you used | Project quarantined, or a name typo |
| Works from a cache, fails on a clean runner | Your cache still holds an older copy |
The third row is the one to watch. A cache can hide the fact that a package has been taken down, and the cached copy may be the one under review.
What to do
- Do not install from another source just to get unblocked, such as a random mirror or a file attached to a forum post.
- Check the project's own repository and announcements for notice of a problem.
- Look in your lock file and caches to find where the package is used.
- If a release is flagged for a security reason, remove the cached copy, rebuild from a clean runner and consider rolling back to a prior version you reviewed.
- Subscribe to advisories for the packages you depend on.
For the related state of a version withdrawn by its maintainer, see PyPI yanked releases and pinned installs.
Planning ahead
You cannot prevent another project's quarantine, but you can soften the effect. Keep an internal mirror or proxy cache of the exact files you approved, so a pinned build does not fail on one removal. Keep the approval record that says who reviewed that version. And keep a short list of your critical dependencies with an owner for each, so a notice reaches someone who can act.
Try it yourself
Click through it at your own pace, or open it full screen. See how a newly disclosed problem is tied back to the components you use.
Quick check
Can a maintainer lift a quarantine themselves?
No. The help page says it cannot be modified by maintainers and administrators must review it.
Is a quarantined package proven malicious?
Not necessarily. It is held for review. Treat it with caution until you know more.
Safeguard's zero-day discovery and SBOM inventory help map an affected package to your projects, and a free scan shows what you depend on.
Sources
Last reviewed: 19 October 2026.
