I don't know that myself but Mike Fiedler is the person to reach out to, he runs security for PyPI and is very responsive. [email protected]