PyPI Blog: Token Exfiltration Campaign via GitHub Actions Workflows(blog.pypi.org)64 points by miketheman 1 year ago | 18 comments
Analysis of supply-chain attack on Ultralytics(blog.pypi.org)79 points by SethMLarson 1 year ago | 18 comments
PyPI now supports digital attestations(blog.pypi.org)207 points by miketheman 1 year ago | 160 comments
PyPI Blog: Releases now reject new files after 14 days(blog.pypi.org)77 points by miketheman 3 months ago | 45 comments