4 ms·
"to compromise a GitHub repository" would be a better title. The vulnerability here is with GitHub Actions combined with improper CI configuration. PyPI has not
by wavemode 2y ago
"to compromise a GitHub repository" would be a better title. The vulnerability here is with GitHub Actions combined with improper CI configuration. PyPI has nothing to do with this, really (other than being the site where this vulnerable repository's releases are uploaded).