Tag: package-publishing

Auditing GitHub-to-PyPI Publishing Paths After the LiteLLM Supply-Chain Attack

pr0h0•October 27, 2026

A hands-on audit of GitHub-to-PyPI publishing paths, tracing how LiteLLM's long-exposed GitHub master key enabled a package compromise and what controls — secret scanning, token revocation, trusted publishing, pinning, and attestations — actually close the gap.

supply-chain-securitypypigithub-actions

Inside npm's New Staged Releases: Defending Against Scripted Supply Chain Attacks

pr0h0•May 25, 2026

A deep technical walkthrough of GitHub's staged publishing changes for npm, how they disrupt scripted supply chain attacks, and what maintainers should do to harden release workflows.

npmsupply-chain-securitygithub