blog.pypi.org Leaked PyPI Tokens Expose 125 Packages to Potential Misuse
Article Content
- •62 active leaked PyPI tokens identified, affecting 125 packages.
- •Most tokens were leaked on GitHub, with a significant number remaining valid.
- •GitHub's integration with PyPI aims to revoke exposed tokens automatically.
GitGuardian reported 62 active leaked PyPI tokens, affecting 125 packages on the platform. The tokens were primarily found on GitHub, with 19,586 occurrences identified, narrowing down to 3,714 unique tokens after filtering. The tokens, which are bearer tokens with specific restrictions, were mostly leaked in 2024. GitHub's scanning integration with PyPI, established in 2021, aims to revoke exposed tokens automatically. However, a significant number of tokens remain valid, indicating gaps in GitHub's scanning capabilities. The potential impact includes around 13,000 monthly downloads across affected packages. GitHub's recent enhancements to secret scanning may improve future detection and revocation of leaked tokens.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host… 
Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…