Token Exfiltration Campaign via GitHub Actions Workflows - The Python Package Index Blog
blog.pypi.org
Incident report of a recent attack campaign targeting GitHub Actions workflows to exfiltrate PyPI tokens, our response, and steps to protect your projects.